CVE-2021-45097: Medium severity knime server vulnerability
KNIME Server before 4.12.6 and 4.13.x before 4.13.4 (when installed in unattended mode) keeps the administrator's password in a file without appropriate file access controls, allowing all local users to read its content.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2021-45097.
What is the severity level of CVE-2021-45097?
The severity level of CVE-2021-45097 is medium with a score of 5.5.
Which software versions are affected by CVE-2021-45097?
KNIME Server versions before 4.12.6 and 4.13.x before 4.13.4 (when installed in unattended mode) are affected.
How can the vulnerability be exploited?
The vulnerability can be exploited by local users to read the administrator's password stored in an insecurely protected file.
Are there any references related to this vulnerability?
Yes, you can find more information about this vulnerability at the following references: [Reference 1](https://github.com/dawid-czarnecki/public-vulnerabilities/tree/master/KNIME/CVE-weak-file-permission) and [Reference 2](https://zigrin.com/advisories/knime-server-weak-file-permissions/).