CVE-2023-50248CWE-130

CKAN out of memory error when submitting the dataset form with a specially-crafted field

Medium · published December 13, 2023

CVSS v3.1
4.5
EPSS
1%
Percentile
47.0
In the wild
Unconfirmed
What it is

CKAN is an open-source data management system for powering data hubs and data portals. Starting in version 2.0.0 and prior to versions 2.9.10 and 2.10.3, when submitting a POST request to the `/dataset/new` endpoint (including either the auth cookie or the `Authorization` header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error, the attacker need to have permissions to create or edit datasets. This vulnerability has been patched in CKAN 2.10.3 and 2.9.10.

The record
Technical detail
CVSS v3.1
4.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00581 · 47.0th percentile
Weakness
CWE-130 · Improper Handling of Length Parameter Inconsistency
Published
2023-12-13T20:47Z
EPSS history
Timeline
  • 13 DEC 20:47Z
    CKAN out of memory error when submitting the dataset form with a specially-crafted field
    cvelistv5