Vulnerability Description
A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade. Users unable to upgrade should override the `/user/reset` endpoint to filter the `id` parameter in order to exclude newlines.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Okfn | Ckan | >= 2.0, < 2.9.11 |
Related Weaknesses (CWE)
References
- https://github.com/ckan/ckan/commit/81b56c55e5e3651d7fcf9642cd5a489a9b62212cPatch
- https://github.com/ckan/ckan/security/advisories/GHSA-8g38-3m6v-232jVendor Advisory
- https://github.com/ckan/ckan/commit/81b56c55e5e3651d7fcf9642cd5a489a9b62212cPatch
- https://github.com/ckan/ckan/security/advisories/GHSA-8g38-3m6v-232jVendor Advisory
FAQ
What is CVE-2024-27097?
CVE-2024-27097 is a vulnerability with a CVSS score of 4.3 (MEDIUM). A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file f...
How severe is CVE-2024-27097?
CVE-2024-27097 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-27097?
Check the references section above for vendor advisories and patch information. Affected products include: Okfn Ckan.