-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from CKAN extensions (like Resource Proxy) fetching resource URLs without proper validation. The advisory explicitly states that Resource Proxy added support for ckan.download_proxy in CKAN 2.10.5, implying prior versions lacked this safeguard. The proxy function in the Resource Proxy controller is directly responsible for fetching external URLs, making it the most likely vulnerable point. While other plugins (XLoader, DataPusher) are mentioned, the CKAN package's direct vulnerability relates to its Resource Proxy implementation. The provided commit diff only updates documentation, so the actual code fix for the vulnerability is inferred from the GHSA details and patched version notes.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ckan | pip | < 2.10.5 | 2.10.5 |