What is GHSA-m2xp-jxfg-qq6g?

GHSA-m2xp-jxfg-qq6g is a security advisory published by GitHub Security Advisories with High severity. CKAN contains Improper Authentication leading to account takeover

Which CVE IDs does GHSA-m2xp-jxfg-qq6g cover?

GHSA-m2xp-jxfg-qq6g covers the following CVE IDs: CVE-2022-43685. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m2xp-jxfg-qq6g?

GHSA-m2xp-jxfg-qq6g has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-m2xp-jxfg-qq6g?

GHSA-m2xp-jxfg-qq6g affects 1 product, including: pip/ckan:\u003c 2.9.7.

GHSA-m2xp-jxfg-qq6gHighCVSS 8.8

CKAN contains Improper Authentication leading to account takeover

Vendor

GitHub Security Advisories

Published

November 22, 2022

Last Modified

April 29, 2025

🔗 CVE IDs covered (1)

CVE-2022-43685 →

📋 Description

CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser accounts.

🎯 Affected products1

pip/ckan:< 2.9.7

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2022-43685
https://ckan.org/blog/get-latest-patch-releases-your-ckan-site-october-2022
https://ckan.org
https://github.com/pypa/advisory-database/tree/main/vulns/ckan/PYSEC-2022-42987.yaml
https://github.com/advisories/GHSA-m2xp-jxfg-qq6g