CVE-2023-32696
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-32696
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-32696.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-32696
- Aliases
-
- GHSA-c74x-xfvr-x5wg
- Published
- 2023-05-30T18:33:53Z
- Modified
- 2025-11-09T15:07:46.668803Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Excessive permissions for ckan user
- Details
-
CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.1, the
ckanuser (equivalent to www-data) owned code and configuration files in the docker container and theckanuser had the permissions to use sudo. These issues allowed for code execution or privilege escalation if an arbitrary file write bug was available. Versions 2.9.9, 2.9.9-dev, 2.10.1, and 2.10.1-dev contain a patch. - Database specific
{ "cwe_ids": [ "CWE-269" ] }- References