CVE-2024-41675: 
Python vulnerability analysis and mitigation

CVE-2024-41675 affects CKAN, an open-source data management system for powering data hubs and data portals. The vulnerability exists in the Datatables view plugin, which failed to properly escape record data coming from the DataStore, leading to a potential Cross-Site Scripting (XSS) vector. The issue affects CKAN versions 2.7.0 and later with the datatables_view plugin activated. The vulnerability was disclosed on August 21, 2024 (GitHub Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS v3.1 scores vary between sources, with GitHub assigning a score of 6.8 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N, and NVD assigning 6.1 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The issue specifically relates to unescaped record data in the Datatables view plugin when displaying DataStore content (NVD).

The vulnerability could allow attackers to execute cross-site scripting attacks through the Datatables view plugin. While the plugin is not activated by default, it is widely used to preview tabular data, potentially affecting many CKAN installations (GitHub Advisory).

The vulnerability requires network access and user interaction to exploit. An attacker needs low privileges to execute the attack, though the specific attack complexity is considered low (GitHub Advisory).

The vulnerability has been patched in CKAN versions 2.10.5 and 2.11.0. As a workaround, administrators can prevent importing of tabular files to the DataStore via DataPusher, XLoader, or similar tools, particularly those from untrusted sources (GitHub Advisory).