CVE-2020-5224 json
Session key exposure through session list in Django User Sessions
published 2020-01-24 6 y ago modified 2026-07-08 4 mo ago also GHSA-5fq8-3q2f-4m5g , PYSEC-2020-230 , EUVD-2020-0066
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 44%
- public exploits
- 0
- none known
Summary
In Django User Sessions (django-user-sessions) before 1.7.1, the views provided allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a problem. However if the website has an XSS vulnerability, the session key could be extracted by the attacker and a session takeover could happen.
Patch / fix
- pypi django-user-sessions 1.7.1
- django-user-sessions_project django-user-sessions 1.7.1
Exploit prediction
0.53% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | django-user-sessions | <1.7.1 |
1.7.1 |
Affected products
- Jazzband django-user-sessions
Classification
References
-
github.com
/jazzband/django-user-sessions/commit/f0c4077e7d1436ba6d721af85cee89222ca5d2d9
web, patch
-
github.com
/Bouke/django-user-sessions/security/advisories/GHSA-5fq8-3q2f-4m5g
web, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-5224
advisory
-
github.com
/Bouke/django-user-sessions
package
-
github.com
/pypa/advisory-database/tree/main/vulns/django-user-sessions/PYSEC-2020-230.yaml
web
Sources
- CVE List CVE-2020-5224
- GitHub Advisory GHSA-5fq8-3q2f-4m5g
- NVD CVE-2020-5224
- OSV PYSEC-2020-230
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.