id: PYSEC-2020-230
details: In Django User Sessions (django-user-sessions) before 1.7.1, the views provided
  allow users to terminate specific sessions. The session key is used to identify
  sessions, and thus included in the rendered HTML. In itself this is not a problem.
  However if the website has an XSS vulnerability, the session key could be extracted
  by the attacker and a session takeover could happen.
affected:
- package:
    name: django-user-sessions
    ecosystem: PyPI
    purl: pkg:pypi/django-user-sessions
  ranges:
  - type: GIT
    repo: https://github.com/jazzband/django-user-sessions
    events:
    - introduced: "0"
    - fixed: f0c4077e7d1436ba6d721af85cee89222ca5d2d9
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.7.1
  versions:
  - 0.1.0
  - 0.1.0-beta
  - 0.1.0-dev
  - 0.1.1
  - 0.1.2
  - 0.1.3
  - 0.1.4
  - 1.0.0
  - 1.0.0-beta1
  - 1.1.0
  - 1.1.1
  - 1.2.0
  - 1.3.0
  - 1.3.1
  - 1.4.0
  - 1.5.0
  - 1.5.1
  - 1.5.2
  - 1.5.3
  - 1.6.0
  - 1.7.0
references:
- type: ADVISORY
  url: https://github.com/Bouke/django-user-sessions/security/advisories/GHSA-5fq8-3q2f-4m5g
- type: FIX
  url: https://github.com/jazzband/django-user-sessions/commit/f0c4077e7d1436ba6d721af85cee89222ca5d2d9
aliases:
- CVE-2020-5224
- GHSA-5fq8-3q2f-4m5g
modified: "2021-08-27T03:21:57.616152Z"
published: "2020-01-24T20:15:00Z"