CVE-2015-2296 in Requests

Summary

The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

• Reservation: 03/14/2015
• Disclosure: 03/18/2015
• Moderation: VulDB entry created
• Entries: VDB-74437
• CPE: ready
• CWE: CWE-384 (Confirmed)
• CVSS: 7.3
• EPSS: 0.01140
• Activities: Very Low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2015-2296
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2015-2296
• CVE Details: https://www.cvedetails.com/cve/CVE-2015-2296/