CVE-2024-27097 MEDIUM

CVE-2024-27097: Potential log injection in reset user endpoint in ckan

Vendor Ckan
Product ckan
Weakness CWE-532 · Sensitive info in logs
Published March 13, 2024
Last update August 21, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade. Users unable to upgrade should override the `/user/reset` endpoint to filter the `id` parameter in order to exclude newlines.

Key dates

02Disclosure timeline

March 13, 2024 CVE published
August 21, 2024 Record updated