Improper Input Validation Affecting aiohttp package, versions [,3.9.0)
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.06% (26th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-AIOHTTP-6091621
- published 28 Nov 2023
- disclosed 27 Nov 2023
- credit Ivan Novikov
Introduced: 27 Nov 2023
CVE-2023-49082 Open this link in a new tabHow to fix?
Upgrade aiohttp to version 3.9.0 or higher.
Overview
Affected versions of this package are vulnerable to Improper Input Validation via the ClientSession method. An attacker can modify the HTTP request or create a new HTTP request if they control the HTTP method.
Note: This is only exploitable if the attacker can control the HTTP method of the request.
Workaround
Perform manual validation of the user value (e.g. by restricting it to a few known values like GET, POST etc.).
References
CVSS Scores
version 3.1