What is CVE-2024-27097?

CVE-2024-27097 is a medium-severity vulnerability in Ckan, classified under Insertion of Sensitive Information into Log File. CVSS score: 4.3/10. Published 2024-03-13.

How severe is CVE-2024-27097?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Is CVE-2024-27097 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Information disclosure in Ckan

CVE-2024-27097

A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN…

EPSS: 0.004 (34.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.

Affected products

Ckan — versions >= 2.0, < 2.9.11, >= 2.10.0, < 2.10.4
Okfn Ckan

Weakness classification (CWE)

CWE-532 — Insertion of Sensitive Information into Log File

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2024-27097?: CVE-2024-27097 is a medium-severity vulnerability in Ckan, classified under Insertion of Sensitive Information into Log File. CVSS score: 4.3/10. Published 2024-03-13.
How severe is CVE-2024-27097?: Medium severity. CVSS v3 base score is 4.3 out of 10.
Is CVE-2024-27097 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.