CVE-2025-54384

{
  "id": "CVE-2025-54384",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-29T16:15:33.893",
  "lastModified": "2026-10-19T13:10:00.110",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, the helpers.markdown_extract() function did not perform sufficient sanitization of input data before wrapping in an HTML literal element. This helper is used to render user-provided data on dataset, resource, organization or group pages (plus any page provided by an extension that used that helper function), leading to a potential XSS vector. This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4."
    },
    {
      "lang": "es",
      "value": "CKAN es un DMS (sistema de gestión de datos) de código abierto para impulsar centros de datos y portales de datos. Antes de 2.10.9 y 2.11.4, la función helpers.markdown_extract() no realizaba una sanitización suficiente de los datos de entrada antes de envolverlos en un elemento literal HTML. Este helper se utiliza para renderizar datos proporcionados por el usuario en páginas de conjuntos de datos, recursos, organizaciones o grupos (además de cualquier página proporcionada por una extensión que utilizara esa función helper), lo que lleva a un vector XSS potencial. Esta vulnerabilidad ha sido corregida en CKAN 2.10.9 y 2.11.4."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ckan",
          "product": "ckan",
          "versions": [
            {
              "version": ">= 2.11.0, < 2.11.4",
              "status": "affected"
            },
            {
              "version": "< 2.10.9",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-29T17:41:04.149339Z",
          "id": "CVE-2025-54384",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ckan/ckan/commit/6d0065f2fc7e2682196d125275af34b93e9e554e",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ckan/ckan/security/advisories/GHSA-2r4h-8jxv-w2j8",
      "source": "[email protected]"
    }
  ]
}