CVE-2023-3140: KNIME Hub Web Application is vulnerable to clickjacking
Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME Business Hub before 1.4.0 has left users vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into clicking on an actionable item, such as a button or link, to another server in which they have an identical webpage. The attacker essentially hijacks the user activity intended for the original server and sends them to the other server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
KNIME Business Hubto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
What is CVE-2023-3140?
CVE-2023-3140 is a vulnerability that involves missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME Business Hub before version 1.4.0, which leaves users vulnerable to clickjacking.
What is clickjacking?
Clickjacking is an attack where an attacker uses a transparent iframe to trick a user into clicking on an actionable item, potentially leading to unintended consequences.
How does CVE-2023-3140 affect KNIME Business Hub?
CVE-2023-3140 affects KNIME Business Hub versions before 1.4.0 by not implementing necessary HTTP headers (X-Frame-Options, Content-Security-Policy) to prevent clickjacking attacks.
What is the severity of CVE-2023-3140?
CVE-2023-3140 has a severity score of 4.3, which is considered medium.
How can I mitigate the vulnerability CVE-2023-3140?
To mitigate CVE-2023-3140, it is recommended to update KNIME Business Hub to version 1.4.0 or later, which includes the necessary HTTP headers to prevent clickjacking.