~ / search / GHSA-m2xp-jxfg-qq6g

GHSA-m2xp-jxfg-qq6g

CKAN contains Improper Authentication leading to account takeover

Source: GitHub Advisory Database (reviewed) High CVE-2022-43685

Packages

EcosystemPackageAffectedFixed in
PyPI ckan < 2.9.7 2.9.7

Details

As written in the advisory (Markdown source, shown as plain text).

CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser accounts.

References

External links from the advisory. They lead to third-party sites.