OpenCVE

KNIME Server before 4.12.6 and 4.13.x before 4.13.4 (when installed in unattended mode) keeps the administrator's password in a file without appropriate file access controls, allowing all local users to read its content.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:L/AC:L/Au:N/C:P/I:N/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Knime	Knime Server

Configuration 1 [-]

OR	cpe:2.3:a:knime:knime_server::::::::
	cpe:2.3:a:knime:knime_server::::::::

No data.

References

Link	Providers
https://github.com/dawid-czarnecki/public-vulnerabilities/tree/master/KNIME/CVE-weak-file-permission
https://zigrin.com/advisories/knime-server-weak-file-permissions/

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2021-12-16T00:00:00

Updated: 2024-08-04T04:32:13.714Z

Reserved: 2021-12-16T00:00:00

Link: CVE-2021-45097

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-12-16T05:15:08.667

Modified: 2024-11-21T06:31:56.943

Link: CVE-2021-45097

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:knime:knime_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "45FAF0A2-5C8E-4C23-ADDE-2975A61B237B", "versionEndIncluding": "4.12.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:knime:knime_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "237B1FB9-69C0-4359-B59F-A987D63D99D3", "versionEndExcluding": "4.13.4", "versionStartIncluding": "4.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "KNIME Server before 4.12.6 and 4.13.x before 4.13.4 (when installed in unattended mode) keeps the administrator's password in a file without appropriate file access controls, allowing all local users to read its content."}, {"lang": "es", "value": "KNIME Server versiones anteriores a 4.12.6 y versiones 4.13.x anteriores a 4.13.4 (cuando se instala en modo desatendido) mantiene la contrase\u00f1a del administrador en un archivo sin los controles de acceso a archivos apropiados, permitiendo a todos los usuarios locales leer su contenido"}], "id": "CVE-2021-45097", "lastModified": "2024-11-21T06:31:56.943", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.4, "impactScore": 1.4, "source": "cve@mitre.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-12-16T05:15:08.667", "references": [{"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "https://github.com/dawid-czarnecki/public-vulnerabilities/tree/master/KNIME/CVE-weak-file-permission"}, {"source": "cve@mitre.org", "url": "https://zigrin.com/advisories/knime-server-weak-file-permissions/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "https://github.com/dawid-czarnecki/public-vulnerabilities/tree/master/KNIME/CVE-weak-file-permission"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://zigrin.com/advisories/knime-server-weak-file-permissions/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}]}