Lucene search

MitreCVE-2015-2296

HistoryMar 18, 2015 - 4:59 p.m.

CVE-2015-2296

2015-03-1816:59:03

mitre

web.nvd.nist.gov

117

security

session fixation

requests

cve-2015-2296

vulnerability

nvd

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

5.7

Confidence

High

EPSS

0.016

Percentile

87.5%

JSON

The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.

Affected configurations

Nvd

Node

mageia_projectmageiaMatch4.0

Node

pythonrequestsMatch2.1.0

pythonrequestsMatch2.2.1

pythonrequestsMatch2.3.0

pythonrequestsMatch2.4.0

pythonrequestsMatch2.4.1

pythonrequestsMatch2.4.2

pythonrequestsMatch2.4.3

pythonrequestsMatch2.5.0

pythonrequestsMatch2.5.1

pythonrequestsMatch2.5.2

pythonrequestsMatch2.5.3

Node

canonicalubuntu_linuxMatch14.04lts

canonicalubuntu_linuxMatch14.10

VendorProductVersionCPE
mageia_projectmageia4.0cpe:2.3:o:mageia_project:mageia:4.0:*:*:*:*:*:*:*
pythonrequests2.1.0cpe:2.3:a:python:requests:2.1.0:*:*:*:*:*:*:*
pythonrequests2.2.1cpe:2.3:a:python:requests:2.2.1:*:*:*:*:*:*:*
pythonrequests2.3.0cpe:2.3:a:python:requests:2.3.0:*:*:*:*:*:*:*
pythonrequests2.4.0cpe:2.3:a:python:requests:2.4.0:*:*:*:*:*:*:*
pythonrequests2.4.1cpe:2.3:a:python:requests:2.4.1:*:*:*:*:*:*:*
pythonrequests2.4.2cpe:2.3:a:python:requests:2.4.2:*:*:*:*:*:*:*
pythonrequests2.4.3cpe:2.3:a:python:requests:2.4.3:*:*:*:*:*:*:*
pythonrequests2.5.0cpe:2.3:a:python:requests:2.5.0:*:*:*:*:*:*:*
pythonrequests2.5.1cpe:2.3:a:python:requests:2.5.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mageia_project	mageia	4.0	cpe:2.3:o:mageia_project:mageia:4.0:::::::*
python	requests	2.1.0	cpe:2.3:a:python:requests:2.1.0:::::::*
python	requests	2.2.1	cpe:2.3:a:python:requests:2.2.1:::::::*
python	requests	2.3.0	cpe:2.3:a:python:requests:2.3.0:::::::*
python	requests	2.4.0	cpe:2.3:a:python:requests:2.4.0:::::::*
python	requests	2.4.1	cpe:2.3:a:python:requests:2.4.1:::::::*
python	requests	2.4.2	cpe:2.3:a:python:requests:2.4.2:::::::*
python	requests	2.4.3	cpe:2.3:a:python:requests:2.4.3:::::::*
python	requests	2.5.0	cpe:2.3:a:python:requests:2.5.0:::::::*
python	requests	2.5.1	cpe:2.3:a:python:requests:2.5.1:::::::*