CVE-2025-3019CWE-79

Cross-site scripting vulnerabilities in KNIME Business Hub web pages

Medium · published March 31, 2025

CVSS v4.0
5.3
EPSS
0%
Percentile
17.8
In the wild
Unconfirmed
What it is

KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. If a user clicks on a malicious link or opens a malicious web page, arbitrary Java Script may be executed with this user's permissions. This can lead to information loss and/or modification of existing data.

The issues are caused by a bug https://github.com/Baroshem/nuxt-security/issues/610 in the widely used nuxt-security module.

There are no viable workarounds therefore we strongly recommend to update to one of the following versions of KNIME Business Hub:

* 1.13.3 or later

* 1.12.4 or later

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/AU:Y/R:U/V:D/RE:M/U:Amber
EPSS
0.00266 · 17.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-03-31T06:49Z
EPSS history
Timeline
  • 31 MAR 06:49Z
    Cross-site scripting vulnerabilities in KNIME Business Hub web pages
    cvelistv5