Description
In CKAN, versions 2.9.0 to 2.9.3 are affected by a stored XSS vulnerability via SVG file upload of users’ profile picture. This allows low privileged application users to store malicious scripts in their profile picture. These scripts are executed in a victim’s browser when they open the malicious profile picture
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ckan | ckan | 2.9.0 – < unspecified, unspecified – ≤ 2.9.3 | unspecified |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | ckan | >= 2.9.0, < 2.10.0 | 2.10.0 | GHSA-6w9p-88qg-p3g3 |
| PyPI | ckan | >= 2.9.0, < 2.9.4 | 2.9.4 | PYSEC-2021-841 |