PYSEC-2019-170

2019-07-1600:15:00

Google

osv.dev

EPSS

0.001

Percentile

31.5%

JSON

An issue was discovered in python-engineio through 3.8.2. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSocket connections to a server by using a victim’s credentials, because the Origin header is not restricted.

CPENameOperatorVersion
python-engineioeq3.2.2
python-engineioeq0.8.0
python-engineioeq1.2.4
python-engineioeq3.5.2
python-engineioeq1.5.3
python-engineioeq0.3.1
python-engineioeq2.3.1
python-engineioeq0.5.1
python-engineioeq0.6.3
python-engineioeq0.9.1

Name	Operator	Version
python-engineio	eq	3.2.2
python-engineio	eq	0.8.0
python-engineio	eq	1.2.4
python-engineio	eq	3.5.2
python-engineio	eq	1.5.3
python-engineio	eq	0.3.1
python-engineio	eq	2.3.1
python-engineio	eq	0.5.1
python-engineio	eq	0.6.3
python-engineio	eq	0.9.1