Em resumo
- CVE-2018-1000814 é uma vulnerabilidade MÉDIO (CVSS 6.5) que afeta aiohttp-session, aiohttp session (aio-libs).
- Chance de exploração nos próximos 30 dias (EPSS): 0.97%, maior que 61.9% das vulnerabilidades.
- Correção: atualize para 2.7.0 ou posterior.
Description
aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value.
NVD description
aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value.
Mais vulnerabilidades de aiohttp-session
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free