CVE-2018-1000519: Medium severity aiohttp vulnerability
aio-libs aiohttp-session contains a Session Fixation vulnerability in loadsession function for RedisStorage (see: https://github.com/aio-libs/aiohttp-session/blob/master/aiohttpsession/redisstorage.py#L42) that can result in Session Hijacking. This attack appear to be exploitable via Any method that allows setting session cookies (?session=<>, or meta tags or script tags with Set-Cookie).
Other sources
The pypi package aiohttp-session before 2.4.0 contained a Session Fixation vulnerability in loadsession function for RedisStorage that can result in Session Hijacking. This attack appear to be exploitable via Any method that allows setting session cookies (?session=<>, or meta tags or script tags with Set-Cookie).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1000519?
CVE-2018-1000519 is classified as a medium severity vulnerability due to the potential for session hijacking.
How do I fix CVE-2018-1000519?
To fix CVE-2018-1000519, upgrade aiohttp-session to version 2.4.0 or later.
What is the impact of CVE-2018-1000519?
The impact of CVE-2018-1000519 is that it allows an attacker to hijack sessions using the load_session function for RedisStorage.
Who is affected by CVE-2018-1000519?
Affecting users of aiohttp-session versions prior to 2.4.0 who utilize Redis for session storage.
What component is vulnerable in CVE-2018-1000519?
The vulnerable component in CVE-2018-1000519 is the load_session function in the RedisStorage of aiohttp-session.