CKAN Vulnerable to Session Cookie Fixation_CVE-2025-64100

6.1 / 10

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

Description

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login. This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4

Basic Information

ID CVE-2025-64100

Source GitHub_M

Published Oct 29, 2025 at 17:54

Modified Oct 29, 2025 at 19:29

Affected Product

Vendor ckan

Product ckan

Version < 2.10.9

Affected Versions ckan ckan < 2.10.9
ckan ckan >= 2.11.0, < 2.11.4

CWE Classification

CWE-384

References

{
    "lastseen": "",
    "description": "CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login. This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4",
    "published": "2025-10-29T17:54:51.997Z",
    "modified": "2025-10-29T19:29:13.337Z",
    "type": "cve",
    "title": "CKAN Vulnerable to Session Cookie Fixation",
    "source": "GitHub_M",
    "references": "https://github.com/ckan/ckan/security/advisories/GHSA-2hvh-cw5c-8q8q\nhttps://github.com/ckan/ckan/commit/c2fe437f88be850a6edf7a32470772428819fab5",
    "id": "CVE-2025-64100",
    "bulletinFamily": "",
    "cwe": [
        "CWE-384"
    ],
    "cvelist": null,
    "sourceData": "ckan ckan < 2.10.9\nckan ckan >= 2.11.0, < 2.11.4",
    "sourceHref": "",
    "cvss": {
        "score": 6.1,
        "severity": "MEDIUM",
        "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "ckan",
    "version": "< 2.10.9",
    "vendor": "ckan",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}