CVE-2019-13611

Advisory

Affected versions of Python-engineio are vulnerable to Cross-Site WebSocket Hijacking (CSWSH), that allows attackers to make WebSocket connections to a server by using a victim's credentials, because the Origin header is not restricted.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

- Address potential websocket cross-origin attacks [128](https://github.com/miguelgrinberg/python-engineio/issues/128) ([commit](https://github.com/miguelgrinberg/python-engineio/commit/7548f704a0a3000b7ac8a6c88796c4ae58aa9c37))
- Documentation for the Same Origin security policy ([commit](https://github.com/miguelgrinberg/python-engineio/commit/5b5879469348c529c283e1d81032a603c5e69b31))
- Remove tests from built package [124](https://github.com/miguelgrinberg/python-engineio/issues/124) ([commit](https://github.com/miguelgrinberg/python-engineio/commit/399dc8acf2077856c4bd8edb22d0f254b47f0ca2)) (thanks **Pablo Escodebar**!)

Resources

• https://pypi.org/project/python-engineio-v3
• https://data.safetycli.com/changelogs/python-engineio-v3/
• https://github.com/miguelgrinberg/python-engineio/commit/7548f704a0a3000b7ac8a6c88796c4ae58aa9c37
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13611