aiohttp-session Session Fixation vulnerability

보통 6.5CVE-2018-1000519 · GHSA-fpwp-69xv-c67f · PYSEC-2018-80 · Published 26/06/2018 · updated 17/06/2026

요약

CVE-2018-1000519은(는) aiohttp-session, aiohttp session (aio-libs)에 영향을 주는 보통 (CVSS 6.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.2%, 전체 취약점의 67.2%보다 높음.
조치: 2.4.0 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
aiohttp-session PyPI	`< 2.4.0`	`2.4.0`
aiohttp session aio-libs	`< 2.4.0`	`2.4.0`

Description

The pypi package aiohttp-session before 2.4.0 contained a Session Fixation vulnerability in load_session function for RedisStorage that can result in Session Hijacking. This attack appear to be exploitable via Any method that allows setting session cookies (?session=<>, or meta tags or script tags with Set-Cookie).

NVD description

aio-libs aiohttp-session contains a Session Fixation vulnerability in load_session function for RedisStorage (see: https://github.com/aio-libs/aiohttp-session/blob/master/aiohttp_session/redis_storage.py#L42) that can result in Session Hijacking. This attack appear to be exploitable via Any method that allows setting session cookies (?session=<>, or meta tags or script tags with Set-Cookie).

References

nvd.nist.gov/vuln/detail/CVE-2018-1000519 · ADVISORY
aio-libs/aiohttp-session · WEB
aio-libs/aiohttp-session commit 6b78640 · WEB
GitHub Advisory GHSA-fpwp-69xv-c67f · ADVISORY
aio-libs/aiohttp-session · PACKAGE
aio-libs/aiohttp-session · WEB
pypa/advisory-database · WEB

aiohttp-session의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

aiohttp-session

PyPI

< 2.4.0

2.4.0

aiohttp session

aio-libs

< 2.4.0

2.4.0

Description

NVD description