GitHub Advisoryadvisory · PyPI

GHSA-2hvh-cw5c-8q8q CKAN vulnerable to fixed session IDs

MEDIUM Published 2025-10-29 Modified 2025-10-29 Official page ↗
Aliases
CVE-2025-64100
Ecosystem
PyPI
Packages
ckan
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Weaknesses
CWE-384
Reviewed
2025-10-29

Affected packages

• PyPI ckan: >= 2.10.0, < 2.10.9 → fixed in 2.10.9 • PyPI ckan: >= 2.11.0, < 2.11.4 → fixed in 2.11.4

Description

Impact Session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login. Patches This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4 References https://en.wikipedia.org/wiki/Session_fixation

Related

Alias · CVE (1)

  • CVE-2025-64100 CKAN is an open-source DMS (data management system) for powering data hubs and data portals. vulnerability

Weakness · CWE (1)

  • CWE-384 Session Fixation weakness

References