CVE-2024-27097
Potential log injection in reset user endpoint in ckan
A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade. Users unable to upgrade should override the /user/reset endpoint to filter the id parameter in order to exclude newlines.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Potential log injection in reset user endpoint in ckan
A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade. Users unable to upgrade should override the /user/reset endpoint to filter the id parameter in order to exclude newlines.
- Record
CVE-2024-27097- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
EUVDEUVD-2024-0874
A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade. Users unable to upgrade should override the /user/reset endpoint to filter the id parameter in order to exclude newlines.
- Record
EUVD-2024-0874- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8g38-3m6v-232j
Potential log injection in reset user endpoint in CKAN
A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format.
Patches
This has been fixed in the CKAN 2.9.11 and 2.10.4 versions
Workarounds
Override the /user/reset endpoint to filter the id parameter in order to exclude newlines
- Record
GHSA-8g38-3m6v-232j- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-117, CWE-532
- Updated
- 2026-11-02
NVD
A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade. Users unable to upgrade should override the /user/reset endpoint to filter the id parameter in order to exclude newlines.
- Record
CVE-2024-27097- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
OSV
Potential log injection in reset user endpoint in ckan
A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade. Users unable to upgrade should override the /user/reset endpoint to filter the id parameter in order to exclude newlines.
- Record
CVE-2024-27097- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
OSVGHSA-8g38-3m6v-232j
Potential log injection in reset user endpoint in CKAN
A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format.
Patches
This has been fixed in the CKAN 2.9.11 and 2.10.4 versions
Workarounds
Override the /user/reset endpoint to filter the id parameter in order to exclude newlines
- Record
GHSA-8g38-3m6v-232j- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-117, CWE-532
- Updated
- 2026-11-02
OSVPYSEC-2026-1251
Potential log injection in reset user endpoint in CKAN
A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format.
Patches
This has been fixed in the CKAN 2.9.11 and 2.10.4 versions
Workarounds
Override the /user/reset endpoint to filter the id parameter in order to exclude newlines
- Record
PYSEC-2026-1251- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ckanPyPI |
before 2.9.11 | 2.9.11 |
ckanPyPI |
2.10.0 up to 2.10.4 | 2.10.4 |
ckanPyPI |
before 2.9.11, plus listed versions 0.110.30.40.50.6 Show 45 moreShow less0.70.81.01.11.21.31.3.21.3.31.41.4.11.4.21.4.31.4.3.11.51.5.11.61.71.7.11.82.02.0.12.0.72.0.82.12.1.12.1.52.1.62.22.2.12.2.32.2.42.32.3.12.3.22.3.32.3.42.3.52.4.02.4.12.4.22.4.32.4.42.4.52.4.82.4.9 |
2.9.11 |
ckanPyPI |
2.10.0 up to 2.10.4, plus listed versions 2.10.12.10.3 |
2.10.4 |
ckanPyPI |
before 2.9.11, 2.10.0 up to 2.10.4, plus listed versions 0.110.30.40.50.6 Show 45 moreShow less0.70.81.01.11.21.31.3.21.3.31.41.4.11.4.21.4.31.4.3.11.51.5.11.61.71.7.11.82.02.0.12.0.72.0.82.12.1.12.1.52.1.62.10.12.10.32.22.2.12.2.32.2.42.32.3.12.3.22.3.32.3.42.3.52.4.02.4.12.4.22.4.32.4.42.4.5 |
2.9.112.10.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-27097 is a medium vulnerability (CVSS 4.3) in Ckan, published March 13, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in ckan 2.9.11.
References
github.com/ckan/ckan/security/advisories/GHSA-8g38-3m6v-232j
docs.ckan.org/en/2.10/changelog.html
nvd.nist.gov/vuln/detail/CVE-2024-27097
Left out here: 112 versions. The JSON record has them.