CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2022-43685
High (8.8) in okfn ckan. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in ckan 2.9.7.
CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser accounts.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
- CWE
- CWE-862
- Published
- Modified
- Record from
- the NVD, synced
Affected
- okfn:ckan
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m2xp-jxfg-qq6g | PyPI | ckan | <2.9.7 | 2.9.7 |
| PYSEC-2022-42987 | PyPI | ckan | <2.9.7 | 2.9.7 |