CVE-2024-41674

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

CKAN is an open-source data management system for powering data hubs and data portals. If there were connection issues with the Solr server, the internal Solr URL (potentially including credentials) could be leaked to package_search calls as part of the returned error message. This has been patched in CKAN 2.10.5 and 2.11.0.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-209

Affected software

No affected versions have been published.

Timeline

Published: Aug 21, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-416756.1CKAN is an open-source data management system for powering data hubs and data portals. The Datatables view plugin did not properly escape re CVE-2024-416764.8Magento-lts is a long-term support alternative to Magento Community Edition (CE). This XSS vulnerability affects the design/header/welcome, CVE-2024-416776.1Qwik is a performance focused javascript framework. A potential mutation XSS vulnerability exists in Qwik for versions up to but not includi CVE-2024-416786.1GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order CVE-2024-416798.8GLPI is a free asset and IT management software package. An authenticated user can exploit a SQL injection vulnerability from the ticket for CVE-2024-41688.8A vulnerability was found in Tenda 4G300 1.01.42. It has been classified as critical. This affects the function sub_4260F0. The manipulation CVE-2024-416817.5A vulnerability has been identified in Location Intelligence family (All versions < V4.4). The web server of affected products is configured CVE-2024-416825.3A vulnerability has been identified in Location Intelligence family (All versions < V4.4). Affected products do not properly enforce restric CVE-2024-416835.3A vulnerability has been identified in Location Intelligence family (All versions < V4.4). Affected products do not properly enforce a stron CVE-2024-416845.3This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing secure flag for the session cookies associated with the route CVE-2024-416857.5This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing HTTPOnly flag for the session cookies associated with the rou CVE-2024-416863.3This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to improper implementation of password policies. A local attacker could