The flaw resides in missing Secure and HttpOnly attributes on sensitive session cookies in KNIME Business Hub versions prior to 1.19.0. This omission alone does not allow exploitation, but when combined with other weaknesses such as cross‑site scripting or a man‑in‑the‑middle attack the attacker can capture or inject session cookies, thereby hijacking user sessions. The weakness corresponds to CWE‑1004 (Improper Validation of Partitioned Data) and CWE‑614 (Sensitive Cookie Without ‘Secure’ and ‘HttpOnly’). The reported CVSS score is 2.1, reflecting the low inherent severity due to the need for additional weaknesses.

Vendors: KNIME – KNIME Business Hub. Affected versions: all releases before 1.19.0. The vulnerability does not extend to later releases, which have fixed the cookie attributes.

With a CVSS of 2.1 and no EPSS information, the likelihood of exploitation in the wild is low. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to exploit an existing XSS or MITM flaw in the target environment; the missing cookie flags merely enable session takeover once a cookie is captured. The attack surface is thus contingent on other concurrent weaknesses rather than the cookie issue alone.