GitHub Advisoryadvisory · PyPI

GHSA-fpwp-69xv-c67f aiohttp-session Session Fixation vulnerability

HIGH Published 2018-09-13 Modified 2025-07-11 Official page ↗
Aliases
CVE-2018-1000519
Ecosystem
PyPI
Packages
aiohttp-session
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weaknesses
CWE-384
Reviewed
2020-06-16

Affected packages

• PyPI aiohttp-session: < 2.4.0 → fixed in 2.4.0

Description

The pypi package aiohttp-session before 2.4.0 contained a Session Fixation vulnerability in `load_session` function for RedisStorage that can result in Session Hijacking. This attack appear to be exploitable via Any method that allows setting session cookies (`?session=<>`, or meta tags or script tags with Set-Cookie).

Related

Alias · CVE (1)

  • CVE-2018-1000519 aio-libs aiohttp-session contains a Session Fixation vulnerability in load_session function for RedisStorage (see:… vulnerability

Weakness · CWE (1)

  • CWE-384 Session Fixation weakness

References