CVE-2024-41674
published 2024-08-21CVE-2024-41674: CKAN is an open-source data management system for powering data hubs and data portals. If there were connection issues with the Solr server, the internal Solr…
PriorityP428medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.38%
29.6th percentile
CKAN is an open-source data management system for powering data hubs and data portals. If there were connection issues with the Solr server, the internal Solr URL (potentially including credentials) could be leaked to package_search calls as part of the returned error message. This has been patched in CKAN 2.10.5 and 2.11.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ckan | ckan | — | — |
| ckan | ckan | >= 2.0.0 < 2.10.5 | 2.10.5 |
| okfn | ckan | >= 2.0 < 2.10.5 | 2.10.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CKAN may leak Solr credentials via error message in package_search action
osv·2024-08-21
CVE-2024-41674 [MEDIUM] CKAN may leak Solr credentials via error message in package_search action
CKAN may leak Solr credentials via error message in package_search action
If there were connection issues with the Solr server, the internal Solr URL (potentially including credentials) could be leaked to `package_search` calls as part of the returned error message
### Patches
This has been patched in CKAN 2.10.5 and 2.11.0
GHSA
CKAN may leak Solr credentials via error message in package_search action
ghsa·2024-08-21
CVE-2024-41674 [MEDIUM] CWE-209 CKAN may leak Solr credentials via error message in package_search action
CKAN may leak Solr credentials via error message in package_search action
If there were connection issues with the Solr server, the internal Solr URL (potentially including credentials) could be leaked to `package_search` calls as part of the returned error message
### Patches
This has been patched in CKAN 2.10.5 and 2.11.0
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-08-21
Published