CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2024-41675
Medium (6.1) in okfn ckan. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in ckan 2.10.5.
CKAN is an open-source data management system for powering data hubs and data portals. The Datatables view plugin did not properly escape record data coming from the DataStore, leading to a potential XSS vector. Sites running CKAN >= 2.7.0 with the datatables_view plugin activated. This is a plugin included in CKAN core, that not activated by default but it is widely used to preview tabular data. This vulnerability has been fixed in CKAN 2.10.5 and 2.11.0.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 34% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- okfn:ckan
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-r3jc-vhf4-6v32 | PyPI | ckan | >=2.7.0 <2.10.5 | 2.10.5 |
| PYSEC-2026-1253 | PyPI | ckan | >=2.7.0 <2.10.5 | 2.10.5 |