CVE-2024-41675

Advisory

CKAN's datatables_view plugin affected versions are vulnerable to a Cross-Site Scripting (XSS) attack due to improper escaping of record data from the DataStore, allowing attackers to inject malicious scripts into tabular data previews. This issue was addressed by implementing proper HTML escaping of data within the plugin, ensuring that any potentially harmful content is neutralized before being rendered in the browser. As a precaution, administrators should prevent importing tabular files from untrusted sources until they have applied the patch.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-r3jc-vhf4-6v32
• https://github.com/ckan/ckan/commit/d7dfe8c427b1c63c75d788a609f3b7d7620a25a1
• https://github.com/ckan/ckan/commit/9e89ce8220ab1445e0bd85a67994a51d9d3d2688
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41675