Back to Database
Status published
Medium
CVE-2024-41674
CKAN may leak Solr credentials via error message in package_search action
Vulnerability Description
CKAN is an open-source data management system for powering data hubs and data portals. If there were connection issues with the Solr server, the internal Solr URL (potentially including credentials) could be leaked to package_search calls as part of the returned error message. This has been patched in CKAN 2.10.5 and 2.11.0.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-41674
Credits & Attribution
No credits recorded in the NVD database.
References
More from ckan
View All →CVE-2025-64100
CKAN Vulnerable to Session Cookie Fixation
Medium
6.1
CVE-2025-54384
CKAN stored XSS vulnerability in Markdown description fields
Medium
6.3
CVE-2025-24372
XSS vector in user uploaded images in group/org and user profiles in ckan
High
7.3
CVE-2024-43371
Potential access to sensitive URLs via CKAN extensions (SSRF)
Medium
4.5
CVE-2024-41675
CKAN has a Cross-site Scripting vector in the Datatables view plugin
Medium
6.8
Affected Vendor
ckan
View all reports →Affected Software
ckan
Vulnerable Versions:
>= 2.0, < 2.10.5
Timeline
Official Publish:
August 21st, 2024
Last Modified:
August 21st, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N