Description (CNA)
Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security issues such as a cross-site scripting vulnerability or a man-in-the-middle attack are present. A workaround is not possible.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| KNIME / KNIME Business Hub | affected 0 before 1.19.0; unaffected 1.19.0 |
CWE
CWE-614, CWE-1004