CVE-2022-31500: 
KNIME Analytics Platform vulnerability analysis and mitigation

CVE-2022-31500 affects KNIME Analytics Platform versions below 4.6.0, where the Windows installer sets improper filesystem permissions. The vulnerability was discovered and reported by Łukasz Rupala & Przemysław Mazurek, with a disclosure date of May 24, 2022 (KNIME Advisory).

The vulnerability has a CVSS v3.1 Base Score of 7.8 HIGH with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The issue is classified as CWE-276 (Incorrect Default Permissions). The vulnerability requires local access, low privileges, and no user interaction to exploit (NVD).

The vulnerability makes the installation directory writeable to everyone on the system, allowing other authenticated local users to place malicious files in the installation directory. This could lead to privilege escalation, particularly if malicious files replace programs that run with administrative privileges during uninstallation (KNIME Advisory).

The vulnerability requires local access and low privileges to exploit. An attacker could replace files in the installation directory, such as the uninstall program, which runs with administrative privileges during application uninstallation (KNIME Advisory).

For existing installations, users can manually restrict the permissions of the installation folder. Starting with KNIME Analytics Platform 4.6.0, the installer restricts write access to the installation directory to admin users only. Users of the self-extracting archive or ZIP file are not affected as default Windows permissions apply (KNIME Advisory).