CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NCVE-2018-1000519
Medium (6.5) in aio-libs aiohttp session. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in aiohttp-session 2.4.0.
aio-libs aiohttp-session contains a Session Fixation vulnerability in load_session function for RedisStorage (see: https://github.com/aio-libs/aiohttp-session/blob/master/aiohttp_session/redis_storage.py#L42) that can result in Session Hijacking. This attack appear to be exploitable via Any method that allows setting session cookies (?session=<>, or meta tags or script tags with Set-Cookie).
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
- CWE
- CWE-384
- Published
- Modified
- Record from
- the NVD, synced
Affected
- aio-libs:aiohttp_session
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fpwp-69xv-c67f | PyPI | aiohttp-session | <2.4.0 | 2.4.0 |
| PYSEC-2018-80 | PyPI | aiohttp-session | <2.4.0 | 2.4.0 |