PYSEC-2019-170 — Vulnetix

PYSEC-2019-170 PUBLISHED

An issue was discovered in python-engineio through 3.8.2. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSocket connections to a server by using a victim's credentials, because the Origin header is not restricted.

Affected Products

Vendor	Product	Versions
PyPI	python-engineio	0.8.5, 0, 0.1.0

Timeline

Jul 16, 2019 CVE Published
Nov 8, 2023 CVE Updated

References

https://github.com/advisories/GHSA-j3jp-gvr5-7hwq advisory
https://github.com/miguelgrinberg/python-engineio/issues/128 discussion

Open in Interactive Console →