PT-2023-31506 · Ckan · Ckan

Thorge · Publicado 2023-12-13 · Atualizado 2023-12-18 · CVE-2023-50248

Positive Technologies (AI Summary)

CVSS v3.1

4.5

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions CKAN versions 2.0.0 through 2.9.9 CKAN versions 2.10.0 through 2.10.2

Description CKAN is an open-source data management system for powering data hubs and data portals. When submitting a POST request to the "/dataset/new" endpoint (including either the auth cookie or the Authorization header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error, the attacker needs to have permissions to create or edit datasets.

Recommendations For CKAN versions 2.0.0 through 2.9.9, update to version 2.9.10 or later. For CKAN versions 2.10.0 through 2.10.2, update to version 2.10.3 or later. As a temporary workaround, consider restricting access to the "/dataset/new" endpoint for users with permissions to create or edit datasets until a patch is applied.

Exploit

Correção

Enumeração de Fraquezas

CWE-130

Identificadores relacionados

CVE-2023-50248

GHSA-7FGC-89CX-W8J5

Produtos afetados

Ckan

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50248.json · Exploit
• https://github.com/ckan/ckan · Nota
• https://github.com/ckan/ckan/security/advisories/GHSA-7fgc-89cx-w8j5 · Aviso do Fabricante
• https://github.com/ckan/ckan/commit/bd02018b65c5b81d7ede195d00d0fcbac3aa33be · Correção
• https://twitter.com/VulmonFeeds/status/1735086842058359175 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-50248 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1735045563010404375 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-50248 · Nota de Segurança
• https://t.me/cvenotify/64006 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-7fgc-89cx-w8j5 · Aviso do Fabricante