PT-2020-18320 · Django · Django-User-Sessions

Bouke · Published 2020-01-24 · Updated 2020-01-29 · CVE-2020-5224

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions django-user-sessions versions prior to 1.7.1

Description The views provided by django-user-sessions allow users to terminate specific sessions, and the session key is included in the rendered HTML. This is not a problem in itself, but if the website has an XSS vulnerability, the session key could be extracted by the attacker, potentially leading to a session takeover.

Recommendations For versions prior to 1.7.1, remove the session key from the template as a workaround until a patch is available.

Fix

Improper Authentication

Inadequate Encryption Strength

Weakness Enumeration

CWE-287

CWE-326

Related Identifiers

CVE-2020-5224

GHSA-5FQ8-3Q2F-4M5G

PYSEC-2020-230

Affected Products

Django-User-Sessions

References · 8

• https://github.com/jazzband/django-user-sessions/commit/f0c4077e7d1436ba6d721af85cee89222ca5d2d9 · Patch
• https://osv.dev/vulnerability/CVE-2020-5224 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5224 · Security Note
• https://osv.dev/vulnerability/GHSA-5fq8-3q2f-4m5g · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-230 · Vendor Advisory
• https://github.com/Bouke/django-user-sessions/security/advisories/GHSA-5fq8-3q2f-4m5g · Note
• https://github.com/Bouke/django-user-sessions · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/django-user-sessions/PYSEC-2020-230.yaml · Note