PT-2023-23970 · Ckan · Ckan

Published 2023-05-30 · Updated 2023-06-06 · CVE-2023-32696

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CKAN versions prior to 2.9.9 CKAN versions prior to 2.10.1

Description CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.1, the ckan user, equivalent to www-data, owned code and configuration files in the docker container and had permissions to use sudo. These issues allowed for code execution or privilege escalation if an arbitrary file write bug was available.

Recommendations For versions prior to 2.9.9, update to version 2.9.9 or later. For versions prior to 2.10.1, update to version 2.10.1 or later.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2023-32696

GHSA-C74X-XFVR-X5WG

Affected Products

Ckan

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32696.json · Exploit
• https://github.com/ckan/ckan-docker-base/security/advisories/GHSA-c74x-xfvr-x5wg · Vendor Advisory
• https://github.com/ckan/ckan-docker-base/commit/5483c46ce9b518a4e1b626ef7032cce2c1d75c7d · Patch
• https://osv.dev/vulnerability/CVE-2023-32696 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32696 · Security Note
• https://t.me/cvenotify/51823 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32696 · Note