CVE-2021-45096

MEDIUM

Knime Analytics Platform < 4.5.0 - XXE

Title source: rule

KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730.

Core 4

Core References

Various Sources

Third Party Advisory

Release Notes

Product

CVSS v3 4.7

EPSS 0.0047

EPSS Percentile 64.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

CWE

CWE-611

Status published

Products (1)

knime/knime_analytics_platform < 4.5.0

Published Dec 16, 2021

Tracked Since Feb 18, 2026