Okfn
Okfn Ckan: vulnerabilidades y CVE
Okfn Ckan tiene 17 vulnerabilidades publicadas, 6 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE17
Últimos 12 meses6
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-42032 | Media (6.7) | 0.41% | — | 13 may 2026 | CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_sql allowed attackers to bypass authorization in order to… |
| CVE-2026-42031 | Alta (8.3) | 2.2% | — | 13 may 2026 | CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_sql allowed attackers to inject SQL in order to gain access… |
| CVE-2026-41255 | Media (6.1) | 0.14% | — | 13 may 2026 | CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, Access to the views via tokens or unauthenticated requests marked the endpoint as not requiring… |
| CVE-2026-41132 | Media (6.6) | 0.21% | — | 13 may 2026 | CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, the configured SMTP server may be spoofed with any certificate (e.g. self-signed), leaving… |
| CVE-2025-64100 | Media (6.1) | 0.30% | — | 29 oct 2025 | CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, session ids could be fixed by an attacker if the site is configured with server-side session… |
| CVE-2025-54384 | Media (6.3) | 0.23% | — | 29 oct 2025 | CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, the helpers.markdown_extract() function did not perform sufficient sanitization of input data… |
| CVE-2025-24372 | Alta (7.3) | 0.46% | — | 5 feb 2025 | CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Using a specially crafted file, a user could potentially upload a file containing code that when executed could send arbitrary… |
| CVE-2024-43371 | Media (6.5) | 0.37% | — | 21 ago 2024 | CKAN is an open-source data management system for powering data hubs and data portals. There are a number of CKAN plugins, including XLoader, DataPusher, Resource proxy and ckanext-archiver, that work by downloading the… |
| CVE-2024-41675 | Media (6.1) | 0.40% | — | 21 ago 2024 | CKAN is an open-source data management system for powering data hubs and data portals. The Datatables view plugin did not properly escape record data coming from the DataStore, leading to a potential XSS vector. Sites… |
| CVE-2024-41674 | Media (5.3) | 0.38% | — | 21 ago 2024 | CKAN is an open-source data management system for powering data hubs and data portals. If there were connection issues with the Solr server, the internal Solr URL (potentially including credentials) could be leaked to… |
| CVE-2024-27097 | Media (5.3) | 0.44% | — | 13 mar 2024 | A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has… |
| CVE-2023-50248 | Media (6.5) | 0.58% | — | 13 dic 2023 | CKAN is an open-source data management system for powering data hubs and data portals. Starting in version 2.0.0 and prior to versions 2.9.10 and 2.10.3, when submitting a POST request to the `/dataset/new` endpoint… |
| CVE-2023-32696 | Alta (8.8) | 0.79% | — | 30 may 2023 | CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.1, the `ckan` user (equivalent to www-data) owned code and configuration files in the docker… |
| CVE-2023-32321 | Crítica (9.8) | 1.7% | — | 26 may 2023 | CKAN is an open-source data management system for powering data hubs and data portals. Multiple vulnerabilities have been discovered in Ckan which may lead to remote code execution. An arbitrary file write in… |
| CVE-2023-22746 | Alta (7.5) | 0.69% | — | 3 feb 2023 | CKAN is an open-source DMS (data management system) for powering data hubs and data portals. When creating a new container based on one of the Docker images listed below, the same secret key was being used by default.… |
| CVE-2022-43685 | Alta (8.8) | 0.73% | — | 22 nov 2022 | CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser accounts. |
| CVE-2021-25967 | Media (5.4) | 0.51% | — | 1 dic 2021 | In CKAN, versions 2.9.0 to 2.9.3 are affected by a stored XSS vulnerability via SVG file upload of users’ profile picture. This allows low privileged application users to store malicious scripts in their profile… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.