CVE-2025-64100

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-10-29

Last updated on: 2025-10-30

Assigner: GitHub, Inc.

Description

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login. This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-29

Last Modified

2025-10-30

Generated

2026-07-06

AI Q&A

2025-10-29

EPSS Evaluated

2026-07-05

NVD

CVE-2025-64100

EUVD

EUVD-2025-36700

Affected Vendors & Products

Vendor	Product	Version / Range
ckan	ckan	2.10.9
ckan	ckan	2.11.4
ckan	ckan	2.10.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-384	Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Attack-Flow Graph

Executive Summary

This vulnerability in CKAN allows an attacker to fix a session ID if the site is configured with server-side session storage. The attacker can do this by setting a cookie on the victim's browser or stealing the victim's valid session. This means the attacker can hijack the victim's session. The issue has been fixed by regenerating session identifiers after each login in CKAN versions 2.10.9 and 2.11.4.

Impact Analysis

The vulnerability can lead to session fixation attacks, allowing an attacker to hijack a user's session. This can result in unauthorized access to the victim's account or data within the CKAN system, potentially compromising sensitive information.

Mitigation Strategies

Upgrade CKAN to version 2.10.9 or 2.11.4 or later, as these versions include a fix that regenerates session identifiers after each login, preventing session fixation attacks. Additionally, ensure that your CKAN installation is not configured to use server-side session storage, or if it is, take extra precautions to protect session cookies from being set or stolen by attackers.

Hi! I’m here to help you understand CVE-2025-64100. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70