GitHub Advisoryadvisory · PyPI

GHSA-5fq8-3q2f-4m5g Session key exposure through session list in Django User Sessions

MEDIUM Published 2020-01-24 Modified 2024-09-16 Official page ↗
Aliases
CVE-2020-5224
Ecosystem
PyPI
Packages
django-user-sessions
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
Weaknesses
CWE-287
Reviewed
2020-01-24

Affected packages

• PyPI django-user-sessions: < 1.7.1 → fixed in 1.7.1

Description

Impact The views provided by django-user-sessions allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a problem. However if the website has an XSS vulnerability, the session key could be extracted by the attacker and a session takeover could happen. Patches Patch is under way. Workarounds Remove the session_key from the template. References _None._ For more information If you have any questions or comments about this advisory: • Open an issue in Bouke/django-user-sessions • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2020-5224 In Django User Sessions (django-user-sessions) before 1.7.1, the views provided allow users to terminate specific sessions. vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References