What is GHSA-2hvh-cw5c-8q8q?

GHSA-2hvh-cw5c-8q8q is a security advisory published by GitHub Security Advisories with Medium severity. CKAN vulnerable to fixed session IDs

Which CVE IDs does GHSA-2hvh-cw5c-8q8q cover?

GHSA-2hvh-cw5c-8q8q covers the following CVE IDs: CVE-2025-64100. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2hvh-cw5c-8q8q?

GHSA-2hvh-cw5c-8q8q has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-2hvh-cw5c-8q8q?

GHSA-2hvh-cw5c-8q8q affects 2 products, including: pip/ckan:\u003e= 2.10.0, \u003c 2.10.9; pip/ckan:\u003e= 2.11.0, \u003c 2.11.4.

GHSA-2hvh-cw5c-8q8qMediumCVSS 6.1

CKAN vulnerable to fixed session IDs

Vendor

GitHub Security Advisories

Published

October 29, 2025

Last Modified

October 29, 2025

🔗 CVE IDs covered (1)

CVE-2025-64100 →

📋 Description

Impact

Session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login.

Patches

This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4

References

https://en.wikipedia.org/wiki/Session_fixation

🎯 Affected products2

pip/ckan:>= 2.10.0, < 2.10.9
pip/ckan:>= 2.11.0, < 2.11.4

🔗 References (4)

https://github.com/ckan/ckan/security/advisories/GHSA-2hvh-cw5c-8q8q
https://nvd.nist.gov/vuln/detail/CVE-2025-64100
https://github.com/ckan/ckan/commit/c2fe437f88be850a6edf7a32470772428819fab5
https://github.com/advisories/GHSA-2hvh-cw5c-8q8q