CVE-2024-27097
Assigner: GitHub_M
Published: 2024-03-13T20:40:50.855Z
State: PUBLISHED
title: Potential log injection in reset user endpoint in ckan
problemTypes: descriptions: cweId: CWE-532
description: CWE-532: Insertion of Sensitive Information into Log File
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
affected: vendor: ckan
product: ckan
versions: version: >= 2.0, < 2.9.11
status: affected
version: >= 2.10.0, < 2.10.4
status: affected
descriptions: value: A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade. Users unable to upgrade should override the `/user/reset` endpoint to filter the `id` parameter in order to exclude newlines.


source: advisory: GHSA-8g38-3m6v-232j
discovery: UNKNOWN