{"cve":"CVE-2024-41674","nvd":{"published":"2024-08-21T15:15:08.770","modified":"2026-06-17T07:48:01.547","status":"Analyzed","description":"CKAN is an open-source data management system for powering data hubs and data portals. If there were connection issues with the Solr server, the internal Solr URL (potentially including credentials) could be leaked to package_search calls as part of the returned error message. This has been patched in CKAN 2.10.5 and 2.11.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3},"cwes":["CWE-209"],"references":["https://github.com/ckan/ckan/commit/f6b032cd7082d784938165bbd113557639002ca7","https://github.com/ckan/ckan/security/advisories/GHSA-2rqw-cfhc-35fh"],"products":["okfn:ckan"],"source":"nvd","synced_at":"2026-10-19T21:54:16.205165117+00:00"},"epss":{"cve":"CVE-2024-41674","score":0.0038,"percentile":0.32058,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-2rqw-cfhc-35fh","url":"https://osv.dev/vulnerability/GHSA-2rqw-cfhc-35fh","summary":"CKAN may leak Solr credentials via error message in package_search action","modified":"2026-07-07T17:56:15.989529003Z","packages":[{"ecosystem":"PyPI","name":"ckan","purl":"pkg:pypi/ckan","ranges":[">=2.0.0 <2.10.5"],"fixed":["2.10.5"]}]},{"id":"PYSEC-2026-1248","url":"https://osv.dev/vulnerability/PYSEC-2026-1248","summary":"CKAN may leak Solr credentials via error message in package_search action","modified":"2026-07-07T17:47:27.095163135Z","packages":[{"ecosystem":"PyPI","name":"ckan","purl":"pkg:pypi/ckan","ranges":[">=2.0.0 <2.10.5"],"fixed":["2.10.5"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}