Aiohttp Session

2 CVEs product

Monthly

Sort: Newest CVSS Score EPSS Score Oldest

CVE-2018-1000814 Dec 20, 15:29 PyPI MEDIUM POC PATCH This Month

aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Information Disclosure Aiohttp Session Aio Libs

NVD GitHub

CVSS 3.1

6.5

EPSS

1.0%

CVE-2018-1000519 Jun 26, 16:29 PyPI MEDIUM POC PATCH This Month

aio-libs aiohttp-session contains a Session Fixation vulnerability in load_session function for RedisStorage (see:. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Information Disclosure Session Fixation Aiohttp Session Aio Libs

NVD GitHub

CVSS 3.1

6.5

EPSS

1.2%

CVE-2018-1000814 PyPI

EPSS 1% CVSS 6.5

MEDIUM POC PATCH This Month

Information Disclosure Aiohttp Session Aio Libs

NVD GitHub

CVE-2018-1000519 PyPI

EPSS 1% CVSS 6.5

MEDIUM POC PATCH This Month

Information Disclosure Session Fixation Aiohttp Session +1

NVD GitHub