CVE-2018-1000519

Name of the Vulnerable Software and Affected Versions aiohttp-session versions prior to 2.4.0

Description The issue concerns a Session Fixation vulnerability in the load session function for RedisStorage. This can result in Session Hijacking. The attack appears to be exploitable via any method that allows setting session cookies, such as ?session=<> or meta tags and script tags with Set-Cookie.

Recommendations For versions prior to 2.4.0, update to version 2.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the load session function for RedisStorage to minimize the risk of exploitation. Avoid using methods that allow setting session cookies until the issue is resolved.