CVE-2024-41675 CKAN has a Cross-site Scripting vector in the Datatables view plugin
Attackers can inject malicious scripts via unescaped DataStore records in the Datatables view plugin, potentially compromising user sessions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-41675?
CVE-2024-41675 is a medium-severity cross-site scripting vulnerability in ckan, published on 21 Aug 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
CKAN is an open-source data management system for powering data hubs and data portals. The Datatables view plugin did not properly escape record data coming from the DataStore, leading to a potential XSS vector. Sites running CKAN >= 2.7.0 with the datatables_view plugin activated. This is a plugin included in CKAN core, that not activated by default but it is widely used to preview tabular data. This vulnerability has been fixed in CKAN 2.10.5 and 2.11.0.
Weakness: CWE-79
Which versions are affected by CVE-2024-41675?
3 open source packages ship an affected version, including ckan. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ckan PyPI | From 2.7.0 | 2.10.5 |
ckan PyPI | From 2.7.0 | 2.10.5 |
ckan PyPI | From 2.7.0 | 2.10.5 |
Products include Okfn Ckan.
How do I fix CVE-2024-41675?
Upgrade ckan to 2.10.5 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-41675 being exploited?
There is no known exploitation of CVE-2024-41675 in the wild and no public exploit code.
Other vulnerabilities in ckan
- CVE-2023-32321 CKAN remote code execution and private information access via crafted resource ids
- CVE-2023-32696 Excessive permissions for ckan user
- CVE-2022-43685 CKAN contains Improper Authentication leading to account takeover
- CVE-2023-22746 CKAN is vulnerable to session secret shared across instances using Docker images
- CVE-2026-42031 CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
Sources
Also known as GHSA-r3jc-vhf4-6v32, PYSEC-2026-1253.