GHSA-2hvh-cw5c-8q8q

Suggest an improvement
Source
https://github.com/advisories/GHSA-2hvh-cw5c-8q8q
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-2hvh-cw5c-8q8q/GHSA-2hvh-cw5c-8q8q.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-2hvh-cw5c-8q8q
Aliases
Published
2025-10-29T21:49:14Z
Modified
2026-07-07T17:56:19Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N CVSS Calculator
Summary
CKAN vulnerable to fixed session IDs
Details

Impact

Session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login.

Patches

This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4

References

https://en.wikipedia.org/wiki/Session_fixation

Database specific 
{
    "cwe_ids":  [
        "CWE-384"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-10-29T21:49:14Z",
    "nvd_published_at":  "2025-10-29T18:15:42Z",
    "severity":  "MODERATE"
}
References

Affected packages

PyPI / ckan

Package

Name
ckan
View open source insights on deps.dev
Purl
pkg:pypi/ckan

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.10.0
Fixed
2.10.9

Affected versions

2.*
2.10.0
2.10.1
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.10.8

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-2hvh-cw5c-8q8q/GHSA-2hvh-cw5c-8q8q.json"

PyPI / ckan

Package

Name
ckan
View open source insights on deps.dev
Purl
pkg:pypi/ckan

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.11.0
Fixed
2.11.4

Affected versions

2.*
2.11.0
2.11.1
2.11.2
2.11.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-2hvh-cw5c-8q8q/GHSA-2hvh-cw5c-8q8q.json"