Unrated severityNVD Advisory· Published May 30, 2023· Updated Jan 9, 2025
Excessive permissions for ckan user
CVE-2023-32696
Description
CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.1, the ckan user (equivalent to www-data) owned code and configuration files in the docker container and the ckan user had the permissions to use sudo. These issues allowed for code execution or privilege escalation if an arbitrary file write bug was available. Versions 2.9.9, 2.9.9-dev, 2.10.1, and 2.10.1-dev contain a patch.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- ckan/ckan-docker-basev5Range: < 2.9.9
Patches
Vulnerability mechanics
References
2- github.com/ckan/ckan-docker-base/commit/5483c46ce9b518a4e1b626ef7032cce2c1d75c7dmitrex_refsource_MISC
- github.com/ckan/ckan-docker-base/security/advisories/GHSA-c74x-xfvr-x5wgmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.