CVE-2025-54384

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-54384", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-07-21T16:12:20.734Z", "datePublished": "2025-10-29T15:26:38.426Z", "dateUpdated": "2025-10-29T17:41:12.571Z"}, "containers": {"cna": {"title": "CKAN stored XSS vulnerability in Markdown description fields", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/ckan/ckan/security/advisories/GHSA-2r4h-8jxv-w2j8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ckan/ckan/security/advisories/GHSA-2r4h-8jxv-w2j8"}, {"name": "https://github.com/ckan/ckan/commit/6d0065f2fc7e2682196d125275af34b93e9e554e", "tags": ["x_refsource_MISC"], "url": "https://github.com/ckan/ckan/commit/6d0065f2fc7e2682196d125275af34b93e9e554e"}], "affected": [{"vendor": "ckan", "product": "ckan", "versions": [{"version": ">= 2.11.0, < 2.11.4", "status": "affected"}, {"version": "< 2.10.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-29T15:26:38.426Z"}, "descriptions": [{"lang": "en", "value": "CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, the helpers.markdown_extract() function did not perform sufficient sanitization of input data before wrapping in an HTML literal element. This helper is used to render user-provided data on dataset, resource, organization or group pages (plus any page provided by an extension that used that helper function), leading to a potential XSS vector. This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4."}], "source": {"advisory": "GHSA-2r4h-8jxv-w2j8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-29T17:41:04.149339Z", "id": "CVE-2025-54384", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-29T17:41:12.571Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-54384", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-29T17:41:04.149339Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-29T17:41:08.445Z"}}], "cna": {"title": "CKAN stored XSS vulnerability in Markdown description fields", "source": {"advisory": "GHSA-2r4h-8jxv-w2j8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "ckan", "product": "ckan", "versions": [{"status": "affected", "version": ">= 2.11.0, < 2.11.4"}, {"status": "affected", "version": "< 2.10.9"}]}], "references": [{"url": "https://github.com/ckan/ckan/security/advisories/GHSA-2r4h-8jxv-w2j8", "name": "https://github.com/ckan/ckan/security/advisories/GHSA-2r4h-8jxv-w2j8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ckan/ckan/commit/6d0065f2fc7e2682196d125275af34b93e9e554e", "name": "https://github.com/ckan/ckan/commit/6d0065f2fc7e2682196d125275af34b93e9e554e", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, the helpers.markdown_extract() function did not perform sufficient sanitization of input data before wrapping in an HTML literal element. This helper is used to render user-provided data on dataset, resource, organization or group pages (plus any page provided by an extension that used that helper function), leading to a potential XSS vector. This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-29T15:26:38.426Z"}}}, "cveMetadata": {"cveId": "CVE-2025-54384", "state": "PUBLISHED", "dateUpdated": "2025-10-29T17:41:12.571Z", "dateReserved": "2025-07-21T16:12:20.734Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-29T15:26:38.426Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ckan", "vendor": "ckan", "versions": [{"status": "affected", "version": ">= 2.11.0, < 2.11.4"}, {"status": "affected", "version": "< 2.10.9"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, the helpers.markdown_extract() function did not perform sufficient sanitization of input data before wrapping in an HTML literal element. This helper is used to render user-provided data on dataset, resource, organization or group pages (plus any page provided by an extension that used that helper function), leading to a potential XSS vector. This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4."}, {"lang": "es", "value": "CKAN es un DMS (sistema de gesti\u00f3n de datos) de c\u00f3digo abierto para impulsar centros de datos y portales de datos. Antes de 2.10.9 y 2.11.4, la funci\u00f3n helpers.markdown_extract() no realizaba una sanitizaci\u00f3n suficiente de los datos de entrada antes de envolverlos en un elemento literal HTML. Este helper se utiliza para renderizar datos proporcionados por el usuario en p\u00e1ginas de conjuntos de datos, recursos, organizaciones o grupos (adem\u00e1s de cualquier p\u00e1gina proporcionada por una extensi\u00f3n que utilizara esa funci\u00f3n helper), lo que lleva a un vector XSS potencial. Esta vulnerabilidad ha sido corregida en CKAN 2.10.9 y 2.11.4."}], "id": "CVE-2025-54384", "lastModified": "2026-10-19T13:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-54384", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-29T17:41:04.149339Z", "version": "2.0.3"}}]}, "published": "2025-10-29T16:15:33.893", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/ckan/ckan/commit/6d0065f2fc7e2682196d125275af34b93e9e554e"}, {"source": "security-advisories@github.com", "url": "https://github.com/ckan/ckan/security/advisories/GHSA-2r4h-8jxv-w2j8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-10-30T14:38:30.126353+00:00", "updated": "2025-10-30T14:38:30.126378+00:00", "vendors": ["ckan", "ckan$PRODUCT$ckan"]}