CVE-2018-1000814

MEDIUM

aio-libs aiohttp-session <=2.6.0 - Non-Expiring Sessions

Title source: llm

Description

aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value.

References (2)

Core 2

Core References

Patch, Third Party Advisory x_refsource_misc

https://github.com/aio-libs/aiohttp-session/pull/331

Exploit, Third Party Advisory x_refsource_misc

https://github.com/aio-libs/aiohttp-session/issues/325

Scores

CVSS v3 6.5

EPSS 0.0097

EPSS Percentile 57.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Details

CWE

CWE-613

Status published

Products (2)

aio-libs/aiohttp_session < 2.6.0

pypi/aiohttp-session 0 - 2.7.0PyPI

Published Dec 20, 2018

Tracked Since Feb 18, 2026