CVE-2019-13611

Advisory

Affected versions of Python-socketio-v4 are vulnerable to Cross-Site WebSocket Hijacking (CSWSH), that allows attackers to make WebSocket connections to a server by using a victim's credentials, because the Origin header is not restricted.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

- Address potential websocket cross-origin attacks [128](https://github.com/miguelgrinberg/python-engineio/issues/128) ([commit](https://github.com/miguelgrinberg/python-engineio/commit/7548f704a0a3000b7ac8a6c88796c4ae58aa9c37))
- Documentation for the Same Origin security policy ([commit](https://github.com/miguelgrinberg/python-socketio/commit/045188c63dffeec82539354fd0498fca969e444e))

Resources

• https://pypi.org/project/python-socketio-v4
• https://data.safetycli.com/changelogs/python-socketio-v4/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13611
• https://github.com/miguelgrinberg/python-socketio/commit/045188c63dffeec82539354fd0498fca969e444e