CVE-2024-27097
Medium
Description
A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade. Users unable to upgrade should override the `/user/reset` endpoint to filter the `id` parameter in order to exclude newlines.
SeverityMedium
CVSS4.3
Exploit probability—
Product
Okfn Ckan
PublishedMar 13, 2024
First seenMar 13, 2024
Weakness typeCWE-532CWE-532
How to fix
Update
- okfn ckan2.9.11, 2.10.4 or later
- ckan2.9.11, 2.10.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| okfn ckan | 2.0 ≤ v < 2.9.11, 2.10.0 ≤ v < 2.10.4 | 2.9.11, 2.10.4 |
| ckanPyPI | v < 2.9.11, 2.10.0 ≤ v < 2.10.4 | 2.9.11, 2.10.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.