Session key exposure through session list in Django User Sessions

CAO 8.8CVE-2020-5224 · GHSA-5fq8-3q2f-4m5g · PYSEC-2020-230 · Công bố 24/01/2020 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2020-5224 là lỗ hổng mức CAO (CVSS 8.8) ảnh hưởng django-user-sessions, django-user-sessions (django-user-sessions project).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.53%, cao hơn 44.9% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.7.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
django-user-sessions PyPI	`< 1.7.1`	`1.7.1`
django-user-sessions django-user-sessions_project	`< 1.7.1`	`1.7.1`

Mô tả

Impact

The views provided by django-user-sessions allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a problem. However if the website has an XSS vulnerability, the session key could be extracted by the attacker and a session takeover could happen.

Patches

Patch is under way.

Workarounds

Remove the session_key from the template.

References

None.

For more information

If you have any questions or comments about this advisory:

Open an issue in Bouke/django-user-sessions
Email us at [email protected]

Mô tả của NVD

In Django User Sessions (django-user-sessions) before 1.7.1, the views provided allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a problem. However if the website has an XSS vulnerability, the session key could be extracted by the attacker and a session takeover could happen.