CVE-2020-5224CWE-287

Session key exposure through session list in Django User Sessions

Medium · published January 24, 2020

CVSS v3.1
6.5
EPSS
1%
Percentile
43.8
In the wild
Unconfirmed
What it is

In Django User Sessions (django-user-sessions) before 1.7.1, the views provided allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a problem. However if the website has an XSS vulnerability, the session key could be extracted by the attacker and a session takeover could happen.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00527 · 43.8th percentile
Weakness
CWE-287 · Improper Authentication
Published
2020-01-24T20:05Z
EPSS history
Timeline
  • 24 JAN 20:05Z
    Session key exposure through session list in Django User Sessions
    cvelistv5