PT-2024-29500 · Ckan+2 · Datatables View Plugin+3

Gatiszeiris · Published 2024-08-21 · Updated 2024-08-23 · CVE-2024-41675

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CKAN versions 2.7.0 through 2.10.4 CKAN version 2.11.0 is not affected, but versions prior to 2.11.0 are vulnerable if they are earlier than 2.10.5.

Description The Datatables view plugin in CKAN did not properly escape record data coming from the DataStore, leading to a potential XSS vector. This issue affects sites running CKAN with the datatables view plugin activated, which is a plugin included in CKAN core but not activated by default. It is widely used to preview tabular data.

Recommendations For CKAN versions 2.7.0 through 2.10.4, update to CKAN 2.10.5 or later to fix the vulnerability. For CKAN versions prior to 2.11.0 and earlier than 2.10.5, update to CKAN 2.11.0 or later to fix the vulnerability. As a temporary workaround, consider preventing the import of tabular files to the DataStore via DataPusher, XLoader, etc., at least those published from untrusted sources.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-41675

GHSA-R3JC-VHF4-6V32

Affected Products

Ckan

Datapusher

Datatables View Plugin

Xloader

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41675.json · Exploit
• https://github.com/ckan/ckan/security/advisories/GHSA-r3jc-vhf4-6v32 · Vendor Advisory
• https://github.com/ckan/ckan/commit/d7dfe8c427b1c63c75d788a609f3b7d7620a25a1 · Patch
• https://github.com/ckan/ckan/commit/9e89ce8220ab1445e0bd85a67994a51d9d3d2688 · Patch
• https://osv.dev/vulnerability/CVE-2024-41675 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41675 · Security Note
• https://osv.dev/vulnerability/GHSA-r3jc-vhf4-6v32 · Vendor Advisory
• https://github.com/ckan/ckan · Note
• https://twitter.com/CVEnew/status/1826280534353256592 · Twitter Post
• https://t.me/cvedetector/3775 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1826298448393453975 · Twitter Post
• https://t.me/cvenotify/91980 · Telegram Post