CVE-2025-64100

Katalog CVE

CVSS 6.1 · Medium EPSS 0,30%

Kerentanan Session Fixation. Skor CVSS 3.1 6.1 (Medium) menurut github.com.

Deskripsi (NVD)

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login. This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4

Rincian

Terbit di NVD

29 Oktober 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

6.1 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-384: Session Fixation

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 20,7% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/ckan/ckan/commit/c2fe437f88be850a6edf7a32470772428819fab5
• https://github.com/ckan/ckan/security/advisories/GHSA-2hvh-cw5c-8q8q