CVE-2024-41675 — MEDIUM (6.8)

Q: How severe is CVE-2024-41675?

CVE-2024-41675 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2024-41675?

Check the references section above for vendor advisories and patch information. Affected products include: Okfn Ckan.

Vulnerability Description

CKAN is an open-source data management system for powering data hubs and data portals. The Datatables view plugin did not properly escape record data coming from the DataStore, leading to a potential XSS vector. Sites running CKAN >= 2.7.0 with the datatables_view plugin activated. This is a plugin included in CKAN core, that not activated by default but it is widely used to preview tabular data. This vulnerability has been fixed in CKAN 2.10.5 and 2.11.0.

CVSS Score

6.8

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Okfn	Ckan	>= 2.7.0, < 2.10.5

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2024-41675?

CVE-2024-41675 is a vulnerability with a CVSS score of 6.8 (MEDIUM). CKAN is an open-source data management system for powering data hubs and data portals. The Datatables view plugin did not properly escape record data coming from the DataStore, leading to a potential ...

How severe is CVE-2024-41675?

CVE-2024-41675 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-41675?

Check the references section above for vendor advisories and patch information. Affected products include: Okfn Ckan.