Medium severity · published Jun 7, 2023
CVE-2023-2541
The Web Frontend of KNIME Business Hub before 1.4.0 allows an unauthenticated remote attacker to access internals about the application such as versions, host names, or IP…
5.3
CVSS
0.6%
EPSS
No
On KEV
Description
The Web Frontend of KNIME Business Hub before 1.4.0 allows an unauthenticated remote attacker to access internals about the application such as versions, host names, or IP addresses. No personal information or application data was exposed.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BH
Business Hub · Knime
before 1.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-2541
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-2541
Vendor Advisory
https://www.knime.com/security/advisories#CVE-2023-2541
Third Party Advisory
https://zigrin.com/advisories/knime-business-hub-sensitive-information-disclosure/
More from Business Hub
8.8
CVE-2025-2787
Ingress-nginx vulnerability in KNIME Business Hub
8.6
CVE-2025-2402
Hard-coded password for object store of KNIME Business Hub
7.2
CVE-2025-11240
Open redirect vulnerability in KNIME Business Hub
7.2
CVE-2025-3019
Cross-site scripting vulnerabilities in KNIME Business Hub web pages
6.5
CVE-2024-6598
A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1