Loading vulnerability details...
Cookies set with the cookies parameter on requests are sent after following a cross-origin redirect.
If a developer uses the cookies parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect.
If unable to upgrade, using a Cookie header in the headers parameter is not vulnerable.
Patch: https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478
Cookies set with the cookies parameter on requests are sent after following a cross-origin redirect.
If a developer uses the cookies parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect.
If unable to upgrade, using a Cookie header in the headers parameter is not vulnerable.
Patch: https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478
This medium-severity vulnerability could be exploited under certain conditions to compromise security controls or access sensitive information. Should be addressed in a timely manner.
Probability of exploitation in the next 30 days · more likely than 10.7% of all CVEs.
Apply security patches to version 3.14.0 immediately
Isolate affected systems from untrusted networks until patching is complete
Implement enhanced monitoring for exploitation attempts and unusual behavior