CVE-2024-41675: CKAN has Cross-site Scripting vector in the Datatables view plugin

August 21, 2024

The Datatables view plugin did not properly escape record data coming from the DataStore, leading to a potential XSS vector.

References

github.com/advisories/GHSA-r3jc-vhf4-6v32
github.com/ckan/ckan
github.com/ckan/ckan/commit/9e89ce8220ab1445e0bd85a67994a51d9d3d2688
github.com/ckan/ckan/commit/d7dfe8c427b1c63c75d788a609f3b7d7620a25a1
github.com/ckan/ckan/security/advisories/GHSA-r3jc-vhf4-6v32
nvd.nist.gov/vuln/detail/CVE-2024-41675

Code Behaviors & Features

Detect and mitigate CVE-2024-41675 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →