Dkan
Monthly
Missing authorization in the Drupal DKAN open-data module allows remote unauthenticated attackers to browse directly to resources that lack an access check, resulting in limited information disclosure. DKAN releases before 4.0.4 and 4.1.x releases before 4.1.5 are affected, with a medium CVSS score of 5.3 and only confidentiality impact. The vendor has released fixes in 4.0.4 and 4.1.5; EPSS is 0.14% (4th percentile) and no public exploit code was identified at time of analysis.
Missing authorization in the Drupal DKAN open-data module allows remote unauthenticated attackers to browse directly to resources that lack an access check, resulting in limited information disclosure. DKAN releases before 4.0.4 and 4.1.x releases before 4.1.5 are affected, with a medium CVSS score of 5.3 and only confidentiality impact. The vendor has released fixes in 4.0.4 and 4.1.5; EPSS is 0.14% (4th percentile) and no public exploit code was identified at time of analysis.