| 0 |
|
| 1 |
|
| 2 |
| url |
VCID-bah9-eeve-zybg |
| vulnerability_id |
VCID-bah9-eeve-zybg |
| summary |
Potential log injection in reset user endpoint in CKAN
A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format.
### Patches
This has been fixed in the CKAN 2.9.11 and 2.10.4 versions
### Workarounds
Override the `/user/reset` endpoint to filter the `id` parameter in order to exclude newlines |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-27097, GHSA-8g38-3m6v-232j
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-bah9-eeve-zybg |
|
| 3 |
| url |
VCID-mfpa-jdxh-vfd3 |
| vulnerability_id |
VCID-mfpa-jdxh-vfd3 |
| summary |
Improper Privilege Management
CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.1, the `ckan` user (equivalent to www-data) owned code and configuration files in the docker container and the `ckan` user had the permissions to use sudo. These issues allowed for code execution or privilege escalation if an arbitrary file write bug was available. Versions 2.9.9, 2.9.9-dev, 2.10.1, and 2.10.1-dev contain a patch. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2023-32696, GHSA-c74x-xfvr-x5wg
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mfpa-jdxh-vfd3 |
|
| 4 |
|
| 5 |
| url |
VCID-t3gx-x14x-2bf9 |
| vulnerability_id |
VCID-t3gx-x14x-2bf9 |
| summary |
Improper Handling of Length Parameter Inconsistency
CKAN is an open-source data management system for powering data hubs and data portals. Starting in version 2.0.0 and prior to versions 2.9.10 and 2.10.3, when submitting a POST request to the `/dataset/new` endpoint (including either the auth cookie or the `Authorization` header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error, the attacker need to have permissions to create or edit datasets. This vulnerability has been patched in CKAN 2.10.3 and 2.9.10. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2023-50248, GHSA-7fgc-89cx-w8j5
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-t3gx-x14x-2bf9 |
|
| 6 |
| url |
VCID-w6cg-ubux-qbfg |
| vulnerability_id |
VCID-w6cg-ubux-qbfg |
| summary |
CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser accounts. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://ckan.org |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
8.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://ckan.org |
|
| 2 |
| reference_url |
https://ckan.org/ |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
8.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-29T04:13:30Z/ |
|
|
| url |
https://ckan.org/ |
|
| 3 |
|
| 4 |
| reference_url |
https://github.com/ckan/ckan |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
8.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/ckan/ckan |
|
| 5 |
|
| 6 |
|
| 7 |
|
|
| fixed_packages |
|
| aliases |
CVE-2022-43685, GHSA-m2xp-jxfg-qq6g, PYSEC-2022-42987
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-w6cg-ubux-qbfg |
|
| 7 |
|
| 8 |
| url |
VCID-zqyk-rq9a-eked |
| vulnerability_id |
VCID-zqyk-rq9a-eked |
| summary |
Use of Insufficiently Random Values
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. When creating a new container based on one of the Docker images listed below, the same secret key was being used by default. If the users didn't set a custom value via environment variables in the `.env` file, that key was shared across different CKAN instances, making it easy to forge authentication requests. Users overriding the default secret key in their own `.env` file are not affected by this issue. Note that the legacy images (ckan/ckan) located in the main CKAN repo are not affected by this issue. The affected images are ckan/ckan-docker, (ckan/ckan-base images), okfn/docker-ckan (openknowledge/ckan-base and openknowledge/ckan-dev images) keitaroinc/docker-ckan (keitaro/ckan images). |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2023-22746, GHSA-pr8j-v4c8-h62x
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-zqyk-rq9a-eked |
|