CVE-2023-5562

Summary

CVE-2023-5562 is a vulnerability affecting KNIME Analytics Platform versions before 5.2.0. The issue involves unsafe default configurations that allow for cross-site scripting attacks. When KNIME Analytics Platform is used as an executor for KNIME Server or KNIME Business Hub, certain JavaScript-based view nodes do not sanitize user data by default. If the data contains JavaScript code, it is executed in the browser, potentially allowing attackers to perform any actions authorized for the current user silently. Although configurable options for data sanitization exist, they are turned off by default, increasing the risk of cross-site scripting attacks. To mitigate this, users of previous releases are advised to enable these settings in the executor's knime.ini file. As of version 5.2.0, KNIME Analytics Platform will enable sanitization by default.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.