CVE-2024-6598 Vulnerability Details

  /     /     /  

CVE-2024-6598 Metadata Quick Info

CVE Published: 09/07/2024 | CVE Updated: 01/08/2024 | CVE Year: 2024
Source: KNIME | Vendor: KNIME | Product: KNIME Business Hub
Status : PUBLISHED

---

CVE-2024-6598 Description

A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1. It allows an authenticated attacker with job execution privileges to execute a job that causes internal messages to pile up until there are no more resources available for processing new messages. This leads to an outage of most functionality of KNIME Business Hub. Recovery from the situation is only possible by manual administrator interaction. Please contact our support for instructions in case you have run into this situation. Updating to KNIME Business Hub 1.10.2 or later solves the problem.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-770
CWE Name: CWE-770 Allocation of Resources Without Limits or Throttling
Source: KNIME

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-130
CAPEC Description: CAPEC-130 Excessive Allocation