A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade. Users unable to upgrade should override the `/user/reset` endpoint to filter the `id` parameter in order to exclude newlines.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Okfn |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-0874 | A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade. Users unable to upgrade should override the `/user/reset` endpoint to filter the `id` parameter in order to exclude newlines. |
 Github GHSA |
GHSA-8g38-3m6v-232j | Potential log injection in reset user endpoint in CKAN |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 23 Jan 2025 21:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Okfn
Okfn ckan |
|
| CPEs | cpe:2.3:a:okfn:ckan:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Okfn
Okfn ckan |
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2024-08-21T15:05:52.767Z
Reserved: 2024-02-19T14:43:05.993Z
Link: CVE-2024-27097
Vulnrichment
Updated: 2024-08-02T00:27:59.495Z
NVD
Status : Analyzed
Published: 2024-03-13T21:15:58.993
Modified: 2025-01-23T21:22:17.240
Link: CVE-2024-27097
Redhat
No data.
OpenCVE Enrichment
No data.