CVE-2022-43685: CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an…

PriorityP350high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

0.68%

47.7th percentile

CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser accounts.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
ckan	ckan	>= 0 < 2.9.7	2.9.7
okfn	ckan	< 2.8.12	2.8.12
okfn	ckan	>= 2.9.0 < 2.9.7	2.9.7

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.