CVE PROGRAM SOURCE RECORD8.8 High

CVE-2022-43685

CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account includi

Status: Published
Published: 2022-11-22
Updated: 2025-04-29
Assigning organization: mitre

Description

CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser accounts.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a n/a

n/aaffected

References

https://ckan.org/ ↗
https://ckan.org/blog/get-latest-patch-releases-your-ckan-site-october-2022 ↗