PT-2021-16891 · Ckan · Ckan

Published 2021-12-01 · Updated 2021-12-03 · CVE-2021-25967

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CKAN versions 2.9.0 through 2.9.3

Description The issue allows low privileged application users to store malicious scripts in their profile picture via SVG file upload. These scripts are executed in a victim’s browser when they open the malicious profile picture.

Recommendations For CKAN versions 2.9.0 through 2.9.3, consider disabling the SVG file upload feature for users’ profile pictures until a patch is available. Restrict access to profile pictures to minimize the risk of exploitation. Avoid using the profile picture feature in the affected versions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-25967

GHSA-6W9P-88QG-P3G3

PYSEC-2021-841

Affected Products

Ckan

References · 12

• https://osv.dev/vulnerability/PYSEC-2021-841 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25967 · Security Note
• https://osv.dev/vulnerability/GHSA-6w9p-88qg-p3g3 · Vendor Advisory
• https://whitesourcesoftware.com/vulnerability-database/CVE-2021-25967 · Patch
• https://osv.dev/vulnerability/CVE-2021-25967 · Vendor Advisory
• https://github.com/ckan/ckan · Note
• https://github.com/ckan/ckan/commit/5a46989c0a4f2c2873ca182c196da83b82babd25 · Note
• https://github.com/ckan/ckan/pull/6477 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/ckan/PYSEC-2021-841.yaml · Note
• https://t.me/cibsecurity/33196 · Telegram Post
• https://github.com/advisories/GHSA-6w9p-88qg-p3g3 · Note
• https://t.me/cvenotify/24122 · Telegram Post