CVE-2025-11240: Open redirect vulnerability in KNIME Business Hub
An open redirect vulnerability existed in KNIME Business Hub prior to version 1.16.0. An unauthenticated remote attacker could craft a link to a legitimate KNIME Business Hub installation which, when opened by the user, redirects the user to a page of the attackers choice. This might open the possibility for fishing or other similar attacks. The problem has been fixed in KNIME Business Hub 1.16.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
KNIME Business Hubto a version that resolves this vulnerability.Fixed in 1.16.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11240?
CVE-2025-11240 is considered a medium severity vulnerability due to its potential for exploitation through social engineering.
How do I fix CVE-2025-11240?
To remediate CVE-2025-11240, upgrade KNIME Business Hub to version 1.16.0 or later.
Who is affected by CVE-2025-11240?
CVE-2025-11240 affects all versions of KNIME Business Hub prior to 1.16.0.
What type of vulnerability is CVE-2025-11240?
CVE-2025-11240 is classified as an open redirect vulnerability.
Can CVE-2025-11240 be exploited without authentication?
Yes, CVE-2025-11240 can be exploited by an unauthenticated remote attacker.