CVE-2024-27097 json
Potential log injection in reset user endpoint in ckan
published 2024-03-13 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-0874 , GHSA-8g38-3m6v-232j , PYSEC-2026-1251
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade. Users unable to upgrade should override the `/user/reset` endpoint to filter the `id` parameter in order to exclude newlines.
Patch / fix
- pypi ckan 2.9.11, 2.10.4
- okfn ckan 2.9.11, 2.10.4
- github.com/ckan/ckan@81b56c5 commit
- github.com/ckan/ckan@5fa133e commit
- github.com/ckan/ckan@d81f411 commit
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| OSV | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | ckan | <2.9.11 >=2.10.0, <2.10.4 |
2.9.11 2.10.4 |
Affected products
- ckan ckan
Classification
References
-
github.com
/ckan/ckan/commit/81b56c55e5e3651d7fcf9642cd5a489a9b62212c
web, patch
-
github.com
/ckan/ckan/commit/5fa133e7e9019573066455b5d442e93c62b3fc93
web
-
github.com
/ckan/ckan/commit/d81f411bff2da7347c343a83e17f5814475b5b64
web
-
github.com
/ckan/ckan/security/advisories/GHSA-8g38-3m6v-232j
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-27097
advisory
-
docs.ckan.org
/en/2.10/changelog.html#v-2-10-4-2024-03-13
web
-
github.com
/ckan/ckan
package
-
pypi.org
/project/ckan
package
-
github.com
/advisories/GHSA-8g38-3m6v-232j
advisory
Sources
- CVE List CVE-2024-27097
- GitHub Advisory GHSA-8g38-3m6v-232j
- NVD CVE-2024-27097
- OSV PYSEC-2026-1251
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.