Session key exposure through session list in Django User Sessions
CVE-2020-5224

6.5MEDIUM

Key Information:

Vendor

Jazzband

Status
Django-user-sessions
Vendor
CVE Published:
24 January 2020

What is CVE-2020-5224?

In Django User Sessions (django-user-sessions) before 1.7.1, the views provided allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a problem. However if the website has an XSS vulnerability, the session key could be extracted by the attacker and a session takeover could happen.

Affected Version(s)

django-user-sessions < 1.7.1

References

https://github.com/Bouke/django-user-sessions/security/ad...
x_refsource_CONFIRM
https://github.com/jazzband/django-user-sessions/commit/f...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.