Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2023-32696 Details

Description

CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.1, the `ckan` user (equivalent to www-data) owned code and configuration files in the docker container and the `ckan` user had the permissions to use sudo. These issues allowed for code execution or privilege escalation if an arbitrary file write bug was available. Versions 2.9.9, 2.9.9-dev, 2.10.1, and 2.10.1-dev contain a patch.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/ckan/ckan-docker-base/commit/5483c46ce9b518a4e1b626ef7032cce2c1d75c7d CVEPatch
https://github.com/ckan/ckan-docker-base/security/advisories/GHSA-c74x-xfvr-x5wg CVEVendor Advisory
https://github.com/ckan/ckan-docker-base/commit/5483c46ce9b518a4e1b626ef7032cce2c1d75c7d [email protected]Patch
https://github.com/ckan/ckan-docker-base/security/advisories/GHSA-c74x-xfvr-x5wg [email protected]Vendor Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-269Improper Privilege Management[email protected]
CWE-269Improper Privilege Management[email protected]

Affected Products

ProductVersions
okfn ckan
< 2.9.9
2.10.0

CPE

  • cpe:2.3:a:okfn:ckan:*:*:*:*:*:*:*:*
  • cpe:2.3:a:okfn:ckan:2.10.0:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

5 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2023-32696
NVD Published Date:
May 30, 2023
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2023-32696 Details - Not Deferred