CVE-2024-6598 — Allocation of Resources Without Limits or Throttling in Business HUB

CWE-770 — Allocation of Resources Without Limits or Throttling3 documents3 sources

Severity

7.1HIGHNVD

EPSS

0.9%

top 24.59%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Knime Business HUB Knime Business HUB

Timeline

PublishedJul 9

Description

A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1. It allows an authenticated attacker with job execution privileges to execute a job that causes internal messages to pile up until there are no more resources available for processing new messages. This leads to an outage of most functionality of KNIME Business Hub. Recovery from the situation is only possible by manual administrator interaction. Please contact our support for instr…

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Packages2 packages

▶NVDknime/business_hub1.10.0 — 1.10.2

▶CVEListV5knime/knime_business_hub1.10.0 — 1.10.2

🔴Vulnerability Details

GHSA

GHSA-p36m-8r3w-rq6p: A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1↗2024-07-09

▶

CVEList

Denial-of-service on KNIME Business Hub when certain jobs are executed↗2024-07-09

▶