CVE-2019-13611: PYSEC-2019-170 - An issue was discovered in python-engineio through 3.8.2. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attack

CVE-2019-13611 · Severity: low · CVSS 3 · Published 2019-07-16

Technologies: python-engineio (PyPI). Vendors: PyPI.

Executive brief

An issue was discovered in python-engineio through 3.8.2. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSocket connections to a server by using a victim's credentials, because the Origin header is not restricted.

Affected products

PyPI python-engineio

Related threats

python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configura
python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the c