GitStock

bouke/django-user-sessions · Security

Session key exposure through session list in Django User Sessions

GHSA ID
GHSA-5fq8-3q2f-4m5g
CVE ID
CVE-2020-5224
Severity
medium
Published
Updated
CVSS
6.5 · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
CVSS v3
6.5 · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
CVSS v4
4.8 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N

Description

Impact

The views provided by django-user-sessions allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a problem. However if the website has an XSS vulnerability, the session key could be extracted by the attacker and a session takeover could happen.

Patches

Patch is under way.

Workarounds

Remove the session_key from the template.

References

None.

For more information

If you have any questions or comments about this advisory:

CWEs

  • CWE-287 · Improper Authentication

References