Vulnerability Details : CVE-2018-1000519
aio-libs aiohttp-session contains a Session Fixation vulnerability in load_session function for RedisStorage (see: https://github.com/aio-libs/aiohttp-session/blob/master/aiohttp_session/redis_storage.py#L42) that can result in Session Hijacking. This attack appear to be exploitable via Any method that allows setting session cookies (?session=<>, or meta tags or script tags with Set-Cookie).
Products affected by CVE-2018-1000519
- cpe:2.3:a:aio-libs_project:aiohttp:-:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-1000519
0.16%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 54 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-1000519
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
|
6.5
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
2.8
|
3.6
|
NIST |
CWE ids for CVE-2018-1000519
-
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-1000519
-
https://github.com/aio-libs/aiohttp-session/blob/master/aiohttp_session/redis_storage.py#L60
aiohttp-session/redis_storage.py at master · aio-libs/aiohttp-session · GitHubThird Party Advisory
-
https://github.com/aio-libs/aiohttp-session/issues/272
Session Fixation vulnerability in RedisStorage · Issue #272 · aio-libs/aiohttp-session · GitHubExploit;Third Party Advisory
Jump to