CVE-2025-64100
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
CKAN is an open-source DMS for data hubs and portals. Prior to 2.10.9 and 2.11.4, session IDs could be fixed by an attacker if the site uses server-side session storage (CKAN uses cookie-based storage by default). The attacker would need to set a cookie on the victim's browser or steal a valid session. Session identifiers are now regenerated after each login.
Risk Assessment
Session hijacking can lead to unauthorized access and data breaches.
Recommendation
Update CKAN to version 2.10.9 or 2.11.4. Consider implementing additional session protection mechanisms such as Secure and HttpOnly cookie flags.
Other vulnerabilities in CKAN
See all- CVE-2026-41132High
CKAN is an open-source data management system that, prior to versions 2.10.10 and 2.11.5, had a vulnerability allowing SMTP server spoofing. This could enable MITM attacks, exposing credentials and all sent emails.
- CVE-2025-54384Medium
Prior to 2.10.9 and 2.11.4, the helpers.markdown_extract() function did not perform sufficient sanitization of input data before wrapping in an HTML literal element. This helper is used to render user-provided data on dataset, resource, organization or group pages, leading to a potential XSS vector.
Original NVD description (English source)
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login. This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4
Vulnerability data from NVD (NIST) · CISA KEV · EPSS