cve.bz

CVE-2020-5224

8.8 highEPSS 0.5%

High (8.8) in django-user-sessions project django-user-sessions. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in django-user-sessions 1.7.1.

In Django User Sessions (django-user-sessions) before 1.7.1, the views provided allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a problem. However if the website has an XSS vulnerability, the session key could be extracted by the attacker and a session takeover could happen.

Severity

CVSS 3.1

8.8 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.5% chance of exploitation in the next 30 days; higher than 44% of CVEs (scores of 2026-10-31)
CWEs
CWE-326, CWE-287
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-5fq8-3q2f-4m5gPyPIdjango-user-sessions<1.7.11.7.1
PYSEC-2020-230PyPIdjango-user-sessions<1.7.11.7.1

References

Check your stackJSON