PT-2025-45654 · Pypi · Ckan

Publicado 2025-10-29 · Atualizado 2025-10-29

OSV

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

Impact

Session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login.

Patches

This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4

References

[https://en.wikipedia.org/wiki/Session fixation](https://en.wikipedia.org/wiki/Session fixation)

Correção

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

GHSA-2HVH-CW5C-8Q8Q

Produtos afetados

Ckan

Referências · 5

• https://github.com/ckan/ckan · Nota
• https://github.com/ckan/ckan/security/advisories/GHSA-2hvh-cw5c-8q8q · Nota
• https://github.com/ckan/ckan/commit/c2fe437f88be850a6edf7a32470772428819fab5 · Nota
• https://osv.dev/vulnerability/GHSA-2hvh-cw5c-8q8q · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-64100 · Nota de Segurança