CVE-2022-44749 is a directory traversal vulnerability, also known as 'Zip-Slip', affecting KNIME Analytics Platform versions 3.2.0 and above. An attacker can craft a malicious KNIME workflow that, when opened by a user, can overwrite arbitrary files on the user's system, potentially leading to data integrity issues or remote code execution. This vulnerability has a CVSS score of 7.0 (HIGH), indicating a local attack vector with high impact on confidentiality, integrity, and availability, requiring user interaction. There is currently no public exploit intelligence, such as Metasploit modules or ExploitDB entries, and it has received no significant community discussion or media coverage, suggesting it is not being actively exploited.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 3.2.0, < 4.6.4CPE matchmatch criteria | cpe:2.3:a:knime:knime_analytics_platform:*:*:*:*:*:*:*:* | ||
>= 3.2.0, < 4.4.5CPE match | cpe:2.3:a:knime:knime_analytics_platform:*:*:*:*:*:*:*:* | ||
>= 4.5.0, < 4.5.3CPE match | cpe:2.3:a:knime:knime_analytics_platform:*:*:*:*:*:*:*:* | ||
>= 4.6.0, < 4.6.4CPE match | cpe:2.3:a:knime:knime_analytics_platform:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.0 Bluesky, 0.1 Mastodon, and 0.0 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.