CVE-2024-27306

2024-04-1815:15:29

Google

osv.dev

aiohttp

asynchronous

http

python

xss

vulnerability

static files

reverse proxy

nginx

upgrade

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.1 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.4%

JSON

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable show_index if unable to upgrade.

CPENameOperatorVersion
aiohttpeq0.3
aiohttpeq0.18.2
aiohttpeq0.15.3
aiohttpeq0.21.5
aiohttpeq0.16.2
aiohttpeq3.5.2
aiohttpeq3.9.0rc0
aiohttpeq2.3.0a2
aiohttpeq3.4.0a3
aiohttpeq3.7.0b1

Name	Operator	Version
aiohttp	eq	0.3
aiohttp	eq	0.18.2
aiohttp	eq	0.15.3
aiohttp	eq	0.21.5
aiohttp	eq	0.16.2
aiohttp	eq	3.5.2
aiohttp	eq	3.9.0rc0
aiohttp	eq	2.3.0a2
aiohttp	eq	3.4.0a3
aiohttp	eq	3.7.0b1