Vulnerability Description
KNIME Server before 4.12.6 and 4.13.x before 4.13.4 (when installed in unattended mode) keeps the administrator's password in a file without appropriate file access controls, allowing all local users to read its content.
CVSS Score
2.9
LOW
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Knime | Knime Server | <= 4.12.5 |
Related Weaknesses (CWE)
References
- https://github.com/dawid-czarnecki/public-vulnerabilities/tree/master/KNIME/CVE-Broken Link
- https://zigrin.com/advisories/knime-server-weak-file-permissions/
- https://github.com/dawid-czarnecki/public-vulnerabilities/tree/master/KNIME/CVE-Broken Link
- https://zigrin.com/advisories/knime-server-weak-file-permissions/
FAQ
What is CVE-2021-45097?
CVE-2021-45097 is a vulnerability with a CVSS score of 2.9 (LOW). KNIME Server before 4.12.6 and 4.13.x before 4.13.4 (when installed in unattended mode) keeps the administrator's password in a file without appropriate file access controls, allowing all local users ...
How severe is CVE-2021-45097?
CVE-2021-45097 has been rated LOW with a CVSS base score of 2.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-45097?
Check the references section above for vendor advisories and patch information. Affected products include: Knime Knime Server.