CVE-2025-2787

KNIME Business Hub is affected by the Ingress-nginx CVE-2025-1974 ( a.k.a IngressNightmare ) vulnerability which affects the ingress-nginx component. In the worst case a complete takeover of the Kubernetes cluster is possible. Since the affected component is only reachable from within the cluster, i.e. requires an authenticated user, the severity in the context of KNIME Business Hub is slightly lower. Besides applying the publicly known workarounds, we strongly recommend updating to one of the following versions of KNIME Business Hub: * 1.13.3 or above * 1.12.4 or above * 1.11.4 or above * 1.10.4 or above *

CVSS

No CVSS.

References

Link	Resource
https://www.knime.com/security-advisory-cve-2025-2787

Configurations

No configuration.

History

31 Mar 2025, 07:15

Type	Values Removed	Values Added
References	~~{'url': 'https://www.knime.com/security/advisories', 'source': 'security@knime.com'}~~	() https://www.knime.com/security-advisory-cve-2025-2787 -

27 Mar 2025, 14:15

Type	Values Removed	Values Added
CWE		CWE-94
Summary		(es) KNIME Business Hub se ve afectado por la vulnerabilidad Ingress-nginx CVE-2025-1974 (también conocida como IngressNightmare), que afecta al componente ingress-nginx. En el peor de los casos, es posible que el clúster de Kubernetes se apodere completamente de él. Dado que el componente afectado solo es accesible desde dentro del clúster, es decir, requiere un usuario autenticado, la gravedad en el contexto de KNIME Business Hub es ligeramente menor. Además de aplicar los workarounds conocidos, recomendamos encarecidamente actualizar a una de las siguientes versiones de KNIME Business Hub: * 1.13.3 o superior * 1.12.4 o superior * 1.11.4 o superior * 1.10.4 o superior *

26 Mar 2025, 22:15

Type	Values Removed	Values Added
References	~~{'url': 'https://www.knime.com/security-advisory-cve-2025-2787', 'source': 'security@knime.com'}~~	() https://www.knime.com/security/advisories -

26 Mar 2025, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-03-26 21:15

Updated : 2025-03-31 07:15

NVD link : CVE-2025-2787

Mitre link : CVE-2025-2787

CVE.ORG link : CVE-2025-2787

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2025-2787", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security@knime.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 8.7, "Automatable": "NO", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Amber", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-03-26T21:15:23.167", "references": [{"url": "https://www.knime.com/security-advisory-cve-2025-2787", "source": "security@knime.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "KNIME Business Hub is affected by the Ingress-nginx CVE-2025-1974 ( a.k.a IngressNightmare ) vulnerability which affects the ingress-nginx component. In the worst case a complete takeover of the Kubernetes cluster is possible. Since the affected component is only reachable from within the cluster, i.e. requires an authenticated user, the severity in the context of KNIME Business Hub is slightly lower.\n\n\n\nBesides applying the publicly known workarounds, we strongly recommend updating to one of the following versions of KNIME Business Hub: \n\n\n\n * 1.13.3 or above \n\n\n\n\n\n\n * 1.12.4 or above \n\n\n\n\n\n\n * 1.11.4 or above \n\n\n\n\n\n\n * 1.10.4 or above\n\n\n\n\n\n\n\n\n *"}, {"lang": "es", "value": "KNIME Business Hub se ve afectado por la vulnerabilidad Ingress-nginx CVE-2025-1974 (tambi\u00e9n conocida como IngressNightmare), que afecta al componente ingress-nginx. En el peor de los casos, es posible que el cl\u00faster de Kubernetes se apodere completamente de \u00e9l. Dado que el componente afectado solo es accesible desde dentro del cl\u00faster, es decir, requiere un usuario autenticado, la gravedad en el contexto de KNIME Business Hub es ligeramente menor. Adem\u00e1s de aplicar los workarounds conocidos, recomendamos encarecidamente actualizar a una de las siguientes versiones de KNIME Business Hub: * 1.13.3 o superior * 1.12.4 o superior * 1.11.4 o superior * 1.10.4 o superior *"}], "lastModified": "2025-03-31T07:15:18.557", "sourceIdentifier": "security@knime.com"}