CVE-2023-5562: 
KNIME Analytics Platform vulnerability analysis and mitigation

An unsafe default configuration in KNIME Analytics Platform before 5.2.2 allows for a cross-site scripting attack. The vulnerability was discovered and disclosed on October 12, 2023, affecting KNIME Analytics Platform when used as an executor for either KNIME Server or KNIME Business Hub (KNIME Advisory, NVD).

The vulnerability stems from JavaScript-based view nodes that do not sanitize displayed data by default. When data containing JavaScript code is displayed, it can be executed in the browser and perform any operations that the current user is allowed to perform silently. The vulnerability has been assigned a CVSS v3.1 Base Score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The weakness is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

If exploited, this vulnerability allows attackers to execute arbitrary JavaScript code in the context of the user's browser session. This can lead to unauthorized actions being performed silently under the user's privileges, potentially compromising data security and system integrity (KNIME Advisory).

The vulnerability requires user interaction and can be exploited when displaying unsanitized data through JavaScript-based view nodes. While KNIME Analytics Platform has configuration options for data sanitization, these were disabled by default in affected versions, making exploitation possible (KNIME Advisory).

The vulnerability has been fixed in KNIME Analytics Platform 5.2.2, which enables sanitization by default. For previous releases, users are recommended to add corresponding sanitization settings to the executor's knime.ini file. Configuration options for data sanitization can be found in the KNIME WebPortal Administration Guide (KNIME Advisory).