CVE-2023-3140 - CVE House
Back to Database
Status published Medium CVE-2023-3140

KNIME Hub Web Application is vulnerable to clickjacking

Vulnerability Description

Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME Business Hub before 1.4.0 has left users vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into clicking on an actionable item, such as a button or link, to another server in which they have an identical webpage. The attacker essentially hijacks the user activity intended for the original server and sends them to the other server.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-3140

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Breachlock

References

More from KNIME

View All →
CVE-2025-3019
Cross-site scripting vulnerabilities in KNIME Business Hub web pages
Medium 5.3
CVE-2025-2787
Ingress-nginx vulnerability in KNIME Business Hub
High 8.7
CVE-2025-2402
Hard-coded password for object store of KNIME Business Hub
High 8.8
CVE-2025-14262
Jobs can be saved as workflows with wrong permissions on KNIME Business Hub
Medium 5.3
CVE-2025-11240
Open redirect vulnerability in KNIME Business Hub
Medium 5.3

Affected Vendor

Affected Software

KNIME Business Hub
Vulnerable Versions:
1.0.0

Timeline

Official Publish: June 7th, 2023
Last Modified: January 6th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-1021

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.