You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
aiohttp-session Session Fixation vulnerability
Moderate severity
GitHub Reviewed
Published
Sep 13, 2018
to the GitHub Advisory Database
•
Updated Sep 3, 2024
The pypi package aiohttp-session before 2.4.0 contained a Session Fixation vulnerability in load_session function for RedisStorage that can result in Session Hijacking. This attack appear to be exploitable via Any method that allows setting session cookies (?session=<>, or meta tags or script tags with Set-Cookie).
The pypi package aiohttp-session before 2.4.0 contained a Session Fixation vulnerability in
load_session
function for RedisStorage that can result in Session Hijacking. This attack appear to be exploitable via Any method that allows setting session cookies (?session=<>
, or meta tags or script tags with Set-Cookie).References