CVE-2023-49081 — Improper Input Validation in Aiohttp
Severity
5.3MEDIUMNVD
CNA7.2OSV7.5
EPSS
0.5%
top 36.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 30
Latest updateJul 17
Description
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4
Affected Packages3 packages
🔴Vulnerability Details
5OSV▶
CVE-2023-49081: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python↗2023-11-30