CVE-2021-25967mediumCWE-79

CVE-2021-25967: falha de média gravidade em ckan

CKAN - Stored Cross-Site Scripting (XSS) via SVG File Upload

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ckan+ Monitorar ckan

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.4epss 0.5%
In CKAN, versions 2.9.0 to 2.9.3 are affected by a stored XSS vulnerability via SVG file upload of users’ profile picture. This allows low privileged application users to store malicious scripts in their profile picture. These scripts are executed in a victim’s browser when they open the malicious profile picture
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
ckan · ckan
CVEs relacionadas — ckan

No mesmo produto, das mais perigosas para as menos.

CVE-2026-42031HIGHCKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`EPSS 1.8%CVE-2023-32321CRITICALCKAN remote code execution and private information access via crafted resource idsEPSS 1.7%CVE-2023-22746HIGHCKAN is vulnerable to session secret shared across instances using Docker imagesEPSS 0.7%CVE-2023-50248MEDIUMCKAN out of memory error when submitting the dataset form with a specially-crafted fieldEPSS 0.6%CVE-2025-24372HIGHXSS vector in user uploaded images in group/org and user profiles in ckanEPSS 0.5%CVE-2024-27097MEDIUMPotential log injection in reset user endpoint in ckanEPSS 0.4%