CVE-2024-6598

A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1. It allows an authenticated attacker with job execution privileges to execute a job that causes internal messages to pile up until there are no more resources available for processing new messages. This leads to an outage of most functionality of KNIME Business Hub. Recovery from the situation is only possible by manual administrator interaction. Please contact our support for instructions in case you have run into this situation. Updating to KNIME Business Hub 1.10.2 or later solves the problem.

CVSS

No CVSS.

References

Link	Resource
https://www.knime.com/security/advisories#CVE-2024-6598
https://www.knime.com/security/advisories#CVE-2024-6598

Configurations

No configuration.

History

21 Nov 2024, 09:49

Type	Values Removed	Values Added
References	~~() https://www.knime.com/security/advisories#CVE-2024-6598 -~~	() https://www.knime.com/security/advisories#CVE-2024-6598 -
Summary		(es) Es posible un ataque de denegación de servicio mediante la funcionalidad de ejecución de KNIME Business Hub 1.10.0 y 1.10.1. Permite que un atacante autenticado con privilegios de ejecución de trabajos ejecute un trabajo que hace que los mensajes internos se acumulen hasta que no haya más recursos disponibles para procesar mensajes nuevos. Esto provoca una interrupción de la mayor parte de las funciones de KNIME Business Hub. La recuperación de la situación sólo es posible mediante la interacción manual del administrador. Comuníquese con nuestro soporte para obtener instrucciones en caso de que se haya encontrado con esta situación. La actualización a KNIME Business Hub 1.10.2 o posterior resuelve el problema.

09 Jul 2024, 14:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-07-09 14:15

Updated : 2024-11-21 09:49

NVD link : CVE-2024-6598

Mitre link : CVE-2024-6598

CVE.ORG link : CVE-2024-6598

JSON object : View

Products Affected

No product.

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2024-6598", "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security@knime.com", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 7.1, "automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "NONE", "vulnerableSystemIntegrity": "NONE", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "vulnerableSystemAvailability": "HIGH", "subsequentSystemConfidentiality": "NONE", "vulnerableSystemConfidentiality": "NONE", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-07-09T14:15:04.803", "references": [{"url": "https://www.knime.com/security/advisories#CVE-2024-6598", "source": "security@knime.com"}, {"url": "https://www.knime.com/security/advisories#CVE-2024-6598", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@knime.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1. It allows an authenticated attacker with job execution privileges to execute a job that causes internal messages to pile up until there are no more resources available for processing new messages. This leads to an outage of most functionality of KNIME Business Hub. Recovery from the situation is only possible by manual administrator interaction. Please contact our support for instructions in case you have run into this situation.\n\n\nUpdating to KNIME Business Hub 1.10.2 or later solves the problem."}, {"lang": "es", "value": "Es posible un ataque de denegaci\u00f3n de servicio mediante la funcionalidad de ejecuci\u00f3n de KNIME Business Hub 1.10.0 y 1.10.1. Permite que un atacante autenticado con privilegios de ejecuci\u00f3n de trabajos ejecute un trabajo que hace que los mensajes internos se acumulen hasta que no haya m\u00e1s recursos disponibles para procesar mensajes nuevos. Esto provoca una interrupci\u00f3n de la mayor parte de las funciones de KNIME Business Hub. La recuperaci\u00f3n de la situaci\u00f3n s\u00f3lo es posible mediante la interacci\u00f3n manual del administrador. Comun\u00edquese con nuestro soporte para obtener instrucciones en caso de que se haya encontrado con esta situaci\u00f3n. La actualizaci\u00f3n a KNIME Business Hub 1.10.2 o posterior resuelve el problema."}], "lastModified": "2024-11-21T09:49:57.550", "sourceIdentifier": "security@knime.com"}