KNIME Server vulnerabilities

Latest KNIME Server CVEs

Newest publication first

1. CVE-2022-44748 Uploading workflows to KNIME Server may override arbitrary file system contents

   Published 2022-11-24

   High·CVSS 7.5 EPSS 1.5%

   A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arbitrary files being overwritten on the server's file system. This vulnerability is also known as 'Zip-Slip'. An attacker can create a KNIME workflow that, when b...

2. CVE-2021-45097 KNIME Server before 4.12.6 and 4.13.x before 4.13.4 (when installed in unattended mode) keeps the administrator's password in a file without appropriate file access controls, allowing all local users....

   Published 2021-12-16

   Medium·CVSS 5.5 EPSS 0.22%

   KNIME Server before 4.12.6 and 4.13.x before 4.13.4 (when installed in unattended mode) keeps the administrator's password in a file without appropriate file access controls, allowing all local users to read its content.

3. CVE-2021-44726 KNIME Server before 4.13.4 allows XSS via the old WebPortal login page.

   Published 2021-12-08

   Medium·CVSS 6.1 EPSS 0.76%

   KNIME Server before 4.13.4 allows XSS via the old WebPortal login page.

4. CVE-2021-44725 KNIME Server before 4.13.4 allows directory traversal in a request for a client profile.

   Published 2021-12-08

   High·CVSS 7.5 EPSS 1.6%

   KNIME Server before 4.13.4 allows directory traversal in a request for a client profile.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.