CVE-2022-43685

CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request

High · published November 22, 2022

CVSS v3.1
8.8
EPSS
1%
Percentile
53.7
In the wild
Unconfirmed
What it is

CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser accounts.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00730 · 53.7th percentile
Published
2022-11-22T00:00Z
EPSS history
Timeline
  • 22 NOV 00:00Z
    CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request
    cvelistv5