Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (2)
| Vulnerability |
Summary |
Aliases |
|
VCID-jtnt-bra7-f3ch
|
CKAN vulnerable to fixed session IDs
Session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login.
|
CVE-2025-64100
GHSA-2hvh-cw5c-8q8q
|
|
VCID-vn22-99r3-nbgz
|
CKAN vulnerable to stored XSS in resource description
The `helpers.markdown_extract()` function did not perform sufficient sanitization of input data before wrapping in an HTML literal element. This helper is used to render user-provided data on dataset, resource, organization or group pages (plus any page provided by an extension that used that helper function), leading to a potential XSS vector.
|
CVE-2025-54384
GHSA-2r4h-8jxv-w2j8
|