CVE-2023-3140

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-3140", "assignerOrgId": "296541fb-a0e3-4ca7-ab3d-683e666d143e", "state": "PUBLISHED", "assignerShortName": "KNIME", "dateReserved": "2023-06-07T09:01:00.528Z", "datePublished": "2023-06-07T09:15:00.112Z", "dateUpdated": "2025-01-06T21:27:10.274Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Web Application"], "product": "KNIME Business Hub", "vendor": "KNIME", "versions": [{"lessThan": "1.4.0", "status": "affected", "version": "1.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Breachlock"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME\n Business Hub before 1.4.0 has left users vulnerable to click \njacking. Clickjacking is an attack that occurs when an attacker uses a \ntransparent iframe in a window to trick a user into clicking on an \nactionable item, such as a button or link, to another server in which \nthey have an identical webpage. The attacker essentially hijacks the \nuser activity intended for the original server and sends them to the \nother server."}], "value": "Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME\n Business Hub before 1.4.0 has left users vulnerable to click \njacking. Clickjacking is an attack that occurs when an attacker uses a \ntransparent iframe in a window to trick a user into clicking on an \nactionable item, such as a button or link, to another server in which \nthey have an identical webpage. The attacker essentially hijacks the \nuser activity intended for the original server and sends them to the \nother server."}], "impacts": [{"capecId": "CAPEC-103", "descriptions": [{"lang": "en", "value": "CAPEC-103 Clickjacking"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1021", "description": "CWE-1021 Improper Restriction of Rendered UI Layers or Frames", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "296541fb-a0e3-4ca7-ab3d-683e666d143e", "shortName": "KNIME", "dateUpdated": "2023-06-07T09:15:00.112Z"}, "references": [{"url": "https://www.knime.com/security/advisories#CVE-2023-3140"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to KNIME Business Hub 1.4.0 or later.<br>"}], "value": "Update to KNIME Business Hub 1.4.0 or later.\n"}], "source": {"discovery": "EXTERNAL"}, "title": "KNIME Hub Web Application is vulnerable to clickjacking", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T06:48:07.354Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.knime.com/security/advisories#CVE-2023-3140", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-06T21:26:57.384107Z", "id": "CVE-2023-3140", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-06T21:27:10.274Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.knime.com/security/advisories#CVE-2023-3140", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T06:48:07.354Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-3140", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-06T21:26:57.384107Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-06T21:27:04.391Z"}}], "cna": {"title": "KNIME Hub Web Application is vulnerable to clickjacking", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Breachlock"}], "impacts": [{"capecId": "CAPEC-103", "descriptions": [{"lang": "en", "value": "CAPEC-103 Clickjacking"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "KNIME", "modules": ["Web Application"], "product": "KNIME Business Hub", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.4.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to KNIME Business Hub 1.4.0 or later.\n", "supportingMedia": [{"type": "text/html", "value": "Update to KNIME Business Hub 1.4.0 or later.<br>", "base64": false}]}], "references": [{"url": "https://www.knime.com/security/advisories#CVE-2023-3140"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME\n Business Hub before 1.4.0 has left users vulnerable to click \njacking. Clickjacking is an attack that occurs when an attacker uses a \ntransparent iframe in a window to trick a user into clicking on an \nactionable item, such as a button or link, to another server in which \nthey have an identical webpage. The attacker essentially hijacks the \nuser activity intended for the original server and sends them to the \nother server.", "supportingMedia": [{"type": "text/html", "value": "Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME\n Business Hub before 1.4.0 has left users vulnerable to click \njacking. Clickjacking is an attack that occurs when an attacker uses a \ntransparent iframe in a window to trick a user into clicking on an \nactionable item, such as a button or link, to another server in which \nthey have an identical webpage. The attacker essentially hijacks the \nuser activity intended for the original server and sends them to the \nother server.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1021", "description": "CWE-1021 Improper Restriction of Rendered UI Layers or Frames"}]}], "providerMetadata": {"orgId": "296541fb-a0e3-4ca7-ab3d-683e666d143e", "shortName": "KNIME", "dateUpdated": "2023-06-07T09:15:00.112Z"}}}, "cveMetadata": {"cveId": "CVE-2023-3140", "state": "PUBLISHED", "dateUpdated": "2025-01-06T21:27:10.274Z", "dateReserved": "2023-06-07T09:01:00.528Z", "assignerOrgId": "296541fb-a0e3-4ca7-ab3d-683e666d143e", "datePublished": "2023-06-07T09:15:00.112Z", "assignerShortName": "KNIME"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Web Application"], "product": "KNIME Business Hub", "vendor": "KNIME", "versions": [{"lessThan": "1.4.0", "status": "affected", "version": "1.0.0", "versionType": "semver"}]}], "source": "security@knime.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:knime:business_hub:*:*:*:*:*:*:*:*", "matchCriteriaId": "247C553F-E9B6-4371-865B-8677893F5FB3", "versionEndExcluding": "1.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME\n Business Hub before 1.4.0 has left users vulnerable to click \njacking. Clickjacking is an attack that occurs when an attacker uses a \ntransparent iframe in a window to trick a user into clicking on an \nactionable item, such as a button or link, to another server in which \nthey have an identical webpage. The attacker essentially hijacks the \nuser activity intended for the original server and sends them to the \nother server."}], "id": "CVE-2023-3140", "lastModified": "2026-06-17T06:13:26.440", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@knime.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-3140", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-01-06T21:26:57.384107Z", "version": "2.0.3"}}]}, "published": "2023-06-07T10:15:09.770", "references": [{"source": "security@knime.com", "tags": ["Vendor Advisory"], "url": "https://www.knime.com/security/advisories#CVE-2023-3140"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.knime.com/security/advisories#CVE-2023-3140"}], "sourceIdentifier": "security@knime.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1021"}], "source": "security@knime.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-1021"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}