PT-2022-27001 · Ckan · Ckan

Published 2022-11-22 · Updated 2025-04-29 · CVE-2022-43685

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CKAN versions 2.9.6 and earlier

Description The issue allows unauthenticated users to take over existing accounts, including superuser accounts, by sending an existing user id via an HTTP POST request. This enables an attacker to gain control of an existing account.

Recommendations For CKAN versions 2.9.6 and earlier, as a temporary workaround, consider restricting access to the user account management functionality until a patch is available. Avoid using the user id variable in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Missing Authorization

Weakness Enumeration

CWE-287

CWE-862

Related Identifiers

CVE-2022-43685

GHSA-M2XP-JXFG-QQ6G

PYSEC-2022-42987

Affected Products

Ckan

References · 10

• https://osv.dev/vulnerability/PYSEC-2022-42987 · Vendor Advisory
• https://ckan.org · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-43685 · Vendor Advisory
• https://ckan.org/blog/get-latest-patch-releases-your-ckan-site-october-2022 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m2xp-jxfg-qq6g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43685 · Security Note
• https://github.com/ckan/ckan · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/ckan/PYSEC-2022-42987.yaml · Note
• https://t.me/cibsecurity/53300 · Telegram Post
• https://t.me/cvenotify/120132 · Telegram Post