PT-2024-29499 · Ckan · Ckan

Fuhuxia · Published 2024-08-21 · Updated 2024-08-23 · CVE-2024-41674

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CKAN versions prior to 2.10.5 CKAN versions prior to 2.11.0

Description CKAN is an open-source data management system for powering data hubs and data portals. If there were connection issues with the Solr server, the internal Solr URL (potentially including credentials) could be leaked to package search calls as part of the returned error message.

Recommendations For CKAN versions prior to 2.10.5, update to version 2.10.5 or later to resolve the issue. For CKAN versions prior to 2.11.0, update to version 2.11.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the package search calls until a patch is available.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2024-41674

GHSA-2RQW-CFHC-35FH

Affected Products

Ckan

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41674.json · Exploit
• https://github.com/ckan/ckan/security/advisories/GHSA-2rqw-cfhc-35fh · Vendor Advisory
• https://github.com/ckan/ckan/commit/f6b032cd7082d784938165bbd113557639002ca7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-41674 · Security Note
• https://osv.dev/vulnerability/GHSA-2rqw-cfhc-35fh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-41674 · Vendor Advisory
• https://github.com/ckan/ckan · Note
• https://twitter.com/VulmonFeeds/status/1826297691833286941 · Twitter Post
• https://t.me/cvenotify/91568 · Telegram Post
• https://twitter.com/CVEnew/status/1826280535527719101 · Twitter Post
• https://t.me/cvedetector/3774 · Telegram Post