Medium severity · published Jul 9, 2024
CVE-2024-6598
A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1. It allows an authenticated attacker with job execution privileges to execute a job that causes internal messages to pile up until there are no more resources available for processing new messages. This leads to an outage of most functionality of KNIME Business Hub. Recovery from the situation is only possible by manual administrator interaction. Please contact our support for instructions in case you have run into this situation.
Updating to KNIME Business Hub 1.10.2 or later solves the problem.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BH
Business Hub · Knime
1.10.0 before 1.10.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-6598
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-6598
Vendor Advisory
https://www.knime.com/security/advisories#CVE-2024-6598
More from Business Hub
8.8
CVE-2025-2787
Ingress-nginx vulnerability in KNIME Business Hub
8.6
CVE-2025-2402
Hard-coded password for object store of KNIME Business Hub
7.2
CVE-2025-11240
Open redirect vulnerability in KNIME Business Hub
7.2
CVE-2025-3019
Cross-site scripting vulnerabilities in KNIME Business Hub web pages
5.3
CVE-2023-2541
The Web Frontend of KNIME Business Hub before 1.4.0 allows an unauthenticated remote attacker to access internals about the application such as versions, host names, or IP…