PyPI/ckan CVE-2021-25967: unknown, EPSS 0.51%

In CKAN, versions 2.9.0 to 2.9.3 are affected by a stored XSS vulnerability via SVG file upload of users’ profile picture. This allows low privileged application users to store malicious scripts in th

Action: Upgrade ckan to 2.9.4 or later.

pip install ckan==2.9.4

Affected

Fixed versions

Sources

• osv: PYSEC-2021-841
• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25967
• https://github.com/advisories/GHSA-6w9p-88qg-p3g3

CVE-2021-25967 · published 2021-12-01T14:15:00Z · modified 2023-11-08T04:05:19.064765Z · JSON