CVE-2025-14262

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14262", "assignerOrgId": "296541fb-a0e3-4ca7-ab3d-683e666d143e", "state": "PUBLISHED", "assignerShortName": "KNIME", "dateReserved": "2025-12-08T09:01:05.011Z", "datePublished": "2025-12-08T09:34:45.784Z", "dateUpdated": "2025-12-08T17:19:30.677Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "modules": ["execution and catalog functionality"], "product": "KNIME Business Hub", "vendor": "KNIME", "versions": [{"lessThan": "1.17.0", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "1.17.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner. The attacker must have permissions to access the jobs but then they were saved into the catalog service using the wrong owner permissions. Therefore it may have been possible to save into spaces where the attacker does not have write permissions.</div><div>There is no workaround.</div>"}], "value": "A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner. The attacker must have permissions to access the jobs but then they were saved into the catalog service using the wrong owner permissions. Therefore it may have been possible to save into spaces where the attacker does not have write permissions.\n\nThere is no workaround."}], "metrics": [{"cvssV4_0": {"Automatable": "YES", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.3, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "GREEN", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:M/U:Green", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "MODERATE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-708", "description": "CWE-708", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "296541fb-a0e3-4ca7-ab3d-683e666d143e", "shortName": "KNIME", "dateUpdated": "2025-12-08T09:34:45.784Z"}, "references": [{"url": "https://www.knime.com/security/advisories#CVE-2025-11239"}], "source": {"discovery": "INTERNAL"}, "title": "Jobs can be saved as workflows with wrong permissions on KNIME Business Hub", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-08T17:19:22.717267Z", "id": "CVE-2025-14262", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-08T17:19:30.677Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14262", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-08T17:19:22.717267Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-08T17:19:27.830Z"}}], "cna": {"title": "Jobs can be saved as workflows with wrong permissions on KNIME Business Hub", "source": {"discovery": "INTERNAL"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 5.3, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:M/U:Green", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "GREEN", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "MODERATE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "KNIME", "modules": ["execution and catalog functionality"], "product": "KNIME Business Hub", "versions": [{"status": "affected", "version": "0", "lessThan": "1.17.0", "versionType": "semver"}, {"status": "unaffected", "version": "1.17.0", "versionType": "semver"}], "defaultStatus": "affected"}], "references": [{"url": "https://www.knime.com/security/advisories#CVE-2025-11239"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner. The attacker must have permissions to access the jobs but then they were saved into the catalog service using the wrong owner permissions. Therefore it may have been possible to save into spaces where the attacker does not have write permissions.\n\nThere is no workaround.", "supportingMedia": [{"type": "text/html", "value": "<div>A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner. The attacker must have permissions to access the jobs but then they were saved into the catalog service using the wrong owner permissions. Therefore it may have been possible to save into spaces where the attacker does not have write permissions.</div><div>There is no workaround.</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-708", "description": "CWE-708"}]}], "providerMetadata": {"orgId": "296541fb-a0e3-4ca7-ab3d-683e666d143e", "shortName": "KNIME", "dateUpdated": "2025-12-08T09:34:45.784Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14262", "state": "PUBLISHED", "dateUpdated": "2025-12-08T17:19:30.677Z", "dateReserved": "2025-12-08T09:01:05.011Z", "assignerOrgId": "296541fb-a0e3-4ca7-ab3d-683e666d143e", "datePublished": "2025-12-08T09:34:45.784Z", "assignerShortName": "KNIME"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "modules": ["execution and catalog functionality"], "product": "KNIME Business Hub", "vendor": "KNIME", "versions": [{"lessThan": "1.17.0", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "1.17.0", "versionType": "semver"}]}], "source": "security@knime.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:knime:business_hub:*:*:*:*:*:*:*:*", "matchCriteriaId": "D16AA853-3F50-4B2F-BFB1-59EE07944BBB", "versionEndExcluding": "1.17.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner. The attacker must have permissions to access the jobs but then they were saved into the catalog service using the wrong owner permissions. Therefore it may have been possible to save into spaces where the attacker does not have write permissions.\n\nThere is no workaround."}, {"lang": "es", "value": "Una comprobaci\u00f3n de permisos err\u00f3nea en KNIME Business Hub antes de la versi\u00f3n 1.17.0 permiti\u00f3 a un usuario autenticado guardar trabajos de otros usuarios como si hubieran sido guardados por el propietario del trabajo. El atacante debe tener permisos para acceder a los trabajos, pero luego estos se guardaron en el servicio de cat\u00e1logo utilizando permisos de propietario err\u00f3neos. Por lo tanto, pudo haber sido posible guardar en espacios donde el atacante no tiene permisos de escritura.\n\nNo hay soluci\u00f3n alternativa."}], "id": "CVE-2025-14262", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "GREEN", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Green", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "MODERATE"}, "source": "security@knime.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14262", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-08T17:19:22.717267Z", "version": "2.0.3"}}]}, "published": "2025-12-08T10:16:01.047", "references": [{"source": "security@knime.com", "tags": ["Vendor Advisory"], "url": "https://www.knime.com/security/advisories#CVE-2025-11239"}], "sourceIdentifier": "security@knime.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-708"}], "source": "security@knime.com", "type": "Secondary"}]}

{}

{"created": "2025-12-09T10:05:23.801734+00:00", "updated": "2025-12-09T10:05:23.801760+00:00", "vendors": ["knime", "knime$PRODUCT$business_hub"]}