Lucene search

GitHub Advisory DatabaseGHSA-M2XP-JXFG-QQ6G

HistoryNov 22, 2022 - 3:30 a.m.

CKAN contains Improper Authentication leading to account takeover

2022-11-2203:30:56

CWE-287

GitHub Advisory Database

github.com

ckan

authentication

account takeover

http

security vulnerability

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

42.8%

JSON

CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser accounts.

Affected configurations

Vulners

Node

ckanckanRange<2.9.7

VendorProductVersionCPE
ckanckan*cpe:2.3:a:ckan:ckan:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ckan	ckan	*	cpe:2.3:a:ckan:ckan::::::::

References

ckan.org

ckan.org/blog/get-latest-patch-releases-your-ckan-site-october-2022

github.com/advisories/GHSA-m2xp-jxfg-qq6g

github.com/pypa/advisory-database/tree/main/vulns/ckan/PYSEC-2022-42987.yaml

nvd.nist.gov/vuln/detail/CVE-2022-43685

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

42.8%

JSON

Related for GHSA-M2XP-JXFG-QQ6G