CVE-2024-41674
CKAN may leak Solr credentials via error message in package_search action
Vexday Risk Score
13Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 5.3EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
21 ago 2024Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
CKAN is an open-source data management system for powering data hubs and data portals. If there were connection issues with the Solr server, the internal Solr URL (potentially including credentials) could be leaked to package_search calls as part of the returned error message. This has been patched in CKAN 2.10.5 and 2.11.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
ckan · ckan¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →