CVE-2019-13611 python-engineio vulnerable to Cross-Site Request Forgery (CSRF)
Attackers can hijack WebSocket connections using victim credentials due to missing Origin header validation in python-engineio.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-13611?
CVE-2019-13611 is a high-severity vulnerability in n/a, published on 15 Jul 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered in python-engineio through 3.8.2. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSocket connections to a server by using a victim's credentials, because the Origin header is not restricted.
Weakness: CWE-352
Which versions are affected by CVE-2019-13611?
3 open source packages ship an affected version, including python-engineio. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
python-engineio PyPI | All versions | 3.9.0 |
python-engineio PyPI | All versions | 3.9.0 |
python-engineio PyPI | All versions | 3.9.0 |
Linux distribution packages (2)
python-python-engineio openSUSE:Tumbleweed | All versions | 4.13.3-1.2 |
python-python-engineio openSUSE:Tumbleweed | All versions | 4.3.4-3.3 |
Products include Python-Engineio Project Python-Engineio.
How do I fix CVE-2019-13611?
Upgrade python-engineio to 3.9.0 or later.
Is CVE-2019-13611 being exploited?
There is no known exploitation of CVE-2019-13611 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2019-13611, GHSA-j3jp-gvr5-7hwq, PYSEC-2019-170, UBUNTU-CVE-2019-13611, openSUSE-SU-2024:11260-1, openSUSE-SU-2024:14157-1 and 1 more.