Vulnerability Name:

CVE-2019-13611 (CCN-163744)

Assigned:2019-07-14
Published:2019-07-14
Updated:2019-07-22
Summary:An issue was discovered in python-engineio through 3.8.2. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSocket connections to a server by using a victim's credentials, because the Origin header is not restricted.
CVSS v3 Severity:8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.7 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
5.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): High
Availibility (A): None
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:C/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Complete
Availibility (A): None
Vulnerability Type:CWE-352
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2019-13611

Source: XF
Type: UNKNOWN
pythonengineio-cve201913611-sec-bypass(163744)

Source: CCN
Type: python-engineio GIT Repository
Websocket hijacking vulnerability #128

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/miguelgrinberg/python-engineio/issues/128

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2019-13611

Vulnerable Configuration:Configuration 1:
  • cpe:/a:python-engineio_project:python-engineio:*:*:*:*:*:*:*:* (Version <= 3.8.2)

    • Configuration CCN 1:
  • cpe:/a:python-engineio_project:python-engineio:3.8.2:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:201913611
    V
    		CVE-2019-13611
    2022-06-30
    oval:org.opensuse.security:def:113289
    P
    		python36-python-engineio-4.2.0-1.2 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:60410
    P
    		Security update for samba (Important)
    2021-11-10
    oval:org.opensuse.security:def:106701
    P
    		python36-python-engineio-4.2.0-1.2 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:63243
    P
    		sysstat-isag-12.0.2-3.6.12 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:61593
    P
    		libxcb-composite0-1.13-3.3.1 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:61594
    P
    		libxerces-c-3_1-3.1.4-3.3.25 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:61617
    P
    		pam_ssh-2.1-2.27 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:61677
    P
    		xdg-utils-20170508-3.2 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:63238
    P
    		skopeo-0.1.32-4.5.1 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:61678
    P
    		xen-libs-4.12.0_12-1.1 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:63377
    P
    		squid-4.13-5.23.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63339
    P
    		libfpm_pb0-1.1.1-2.29 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63431
    P
    		libgstreamer-1_0-0-32bit-1.16.2-1.53 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63378
    P
    		stunnel-5.57-3.11.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63515
    P
    		python2-ovs-2.11.5-3.15.3 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63481
    P
    		libSDL2-2_0-0-32bit-2.0.8-9.63 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63327
    P
    		freeradius-server-3.0.21-3.6.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:62059
    P
    		dbus-1-1.12.2-8.3.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62253
    P
    		libzip-devel-1.5.1-1.9 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62383
    P
    		containerd-1.3.9-5.29.3 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62146
    P
    		libcryptopp-devel-5.6.5-1.3.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62342
    P
    		umoci-0.4.6-3.9.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:63042
    P
    		python39-tools-3.9.4-2.9 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:63009
    P
    		go1.14-1.14.15-1.35.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:60314
    P
    		Security update for qemu (Important)
    2021-07-22
    oval:org.opensuse.security:def:59714
    P
    		Security update for xorg-x11-server (Important)
    2021-04-13
    oval:org.opensuse.security:def:60492
    P
    		Security update for MozillaFirefox (Important)
    2021-03-31
    oval:org.opensuse.security:def:59599
    P
    		Security update for grub2 (Important)
    2021-03-02
    oval:org.opensuse.security:def:60451
    P
    		Security update for screen (Important)
    2021-02-17
    oval:org.opensuse.security:def:59844
    P
    		Security update for wpa_supplicant (Important)
    2021-02-15
    oval:org.opensuse.security:def:60151
    P
    		Security update for the Linux Kernel (Important)
    2020-12-09
    oval:org.opensuse.security:def:63276
    P
    		libmariadb-devel-3.1.8-3.18.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:61701
    P
    		autoyast2-4.2.37-1.6 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63410
    P
    		nodejs8-8.17.0-8.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:61872
    P
    		libpython3_6m1_0-3.6.10-3.53.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62593
    P
    		perl-CGI-4.38-1.17 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62912
    P
    		openldap2-devel-32bit-2.4.46-9.3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62474
    P
    		libthai-devel-0.1.27-1.16 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62688
    P
    		libopenjpeg1-1.5.2-2.28 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63144
    P
    		bind-9.11.2-10.4 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:61786
    P
    		libX11-6-1.6.5-3.3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63140
    P
    		apache2-mod_apparmor-2.12-5.9 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:58988
    P
    		Security update for the Linux Kernel (Live Patch 10 for SLE 12 SP2) (Important)
    2020-12-01
    oval:org.opensuse.security:def:59010
    P
    		Security update for krb5 (Important)
    2020-12-01
    oval:org.opensuse.security:def:59227
    P
    		Security update for qemu (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:59166
    P
    		Security update for texlive (Important)
    2020-12-01
    oval:org.opensuse.security:def:59228
    P
    		Security update for krb5-appl (Important)
    2020-12-01
    oval:org.opensuse.security:def:60569
    P
    		xdg-utils on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:59418
    P
    		Security update for dovecot22 (Important)
    2020-12-01
    oval:org.opensuse.security:def:60530
    P
    		res-signingkeys on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:59250
    P
    		Security update for python3-requests (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60666
    P
    		Security update for strongswan (Important)
    2020-12-01
    oval:org.opensuse.security:def:60647
    P
    		Security update for ardana-ansible, ardana-glance, ardana-horizon, ardana-input-model, ardana-manila, ardana-neutron, ardana-nova, ardana-octavia, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, galera-3, grafana, mariadb, mariadb-connector-c, novnc, openstack-cinder, openstack-glance, openstack-heat, openstack-horizon-plugin-neutron-vpnaas-ui, openstack-keystone, openstack-monasca-installer, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, python-amqp, python-ovs, python-pysaml2, python-python-engineio, python-urllib3, release-notes-suse-openstack-cloud, rubygem-easy_diff, rubygem-rest-client-1_6, venv-openstack-keystone (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60619
    P
    		Security update for ardana-ansible, ardana-db, ardana-freezer, ardana-glance, ardana-input-model, ardana-nova, ardana-osconfig, ardana-tempest, caasp-openstack-heat-templates, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, documentation-suse-openstack-cloud, galera-python-clustercheck, openstack-cinder, openstack-glance, openstack-heat, openstack-horizon-plugin-monasca-ui, openstack-horizon-plugin-neutron-fwaas-ui, openstack-ironic, openstack-keystone, openstack-manila, openstack-monasca-agent, openstack-monasca-api, openstack-monasca-persister, openstack-monasca-persister-java, openstack-murano, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, python-Beaver, python-oslo.db, python-osprofiler, python-swiftlm, venv-openstack-magnum, venv-openstack-monasca, venv-openstack-monasca-ceilometer, venv-openstack-murano, venv-openstack-neutron (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:59408
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:60750
    P
    		Security update for xorg-x11-server (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60829
    P
    		Security update for squid (Important)
    2020-12-01
    oval:org.opensuse.security:def:59661
    P
    		Security update for xerces-c (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60788
    P
    		Security update for gcc10 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:59899
    P
    		Security update for java-1_8_0-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:60908
    P
    		Security update for ardana-ansible, ardana-glance, ardana-horizon, ardana-input-model, ardana-manila, ardana-neutron, ardana-nova, ardana-octavia, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, galera-3, grafana, mariadb, mariadb-connector-c, novnc, openstack-cinder, openstack-glance, openstack-heat, openstack-horizon-plugin-neutron-vpnaas-ui, openstack-keystone, openstack-monasca-installer, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, python-amqp, python-ovs, python-pysaml2, python-python-engineio, python-urllib3, release-notes-suse-openstack-cloud, rubygem-easy_diff, rubygem-rest-client-1_6, venv-openstack-keystone (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60879
    P
    		Security update for rubygem-loofah (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:58987
    P
    		Security update for the Linux Kernel (Live Patch 11 for SLE 12 SP2) (Important)
    2020-12-01
    oval:org.opensuse.security:def:60198
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:59962
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:83913
    P
    		Security update for ardana-ansible, ardana-glance, ardana-horizon, ardana-input-model, ardana-manila, ardana-neutron, ardana-nova, ardana-octavia, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, galera-3, grafana, mariadb, mariadb-connector-c, novnc, openstack-cinder, openstack-glance, openstack-heat, openstack-horizon-plugin-neutron-vpnaas-ui, openstack-keystone, openstack-monasca-installer, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, python-amqp, python-ovs, python-pysaml2, python-python-engineio, python-urllib3, release-notes-suse-openstack-cloud, rubygem-easy_diff, rubygem-rest-client-1_6, venv-openstack-keystone (Moderate)
    2019-10-30
    oval:org.opensuse.security:def:84361
    P
    		Security update for ardana-ansible, ardana-glance, ardana-horizon, ardana-input-model, ardana-manila, ardana-neutron, ardana-nova, ardana-octavia, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, galera-3, grafana, mariadb, mariadb-connector-c, novnc, openstack-cinder, openstack-glance, openstack-heat, openstack-horizon-plugin-neutron-vpnaas-ui, openstack-keystone, openstack-monasca-installer, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, python-amqp, python-ovs, python-pysaml2, python-python-engineio, python-urllib3, release-notes-suse-openstack-cloud, rubygem-easy_diff, rubygem-rest-client-1_6, venv-openstack-keystone (Moderate)
    2019-10-30
    oval:org.opensuse.security:def:88286
    P
    		Security update for ardana-ansible, ardana-barbican, ardana-cinder, ardana-cluster, ardana-cobbler, ardana-db, ardana-designate, ardana-extensions-nsx, ardana-glance, ardana-heat, ardana-horizon, ardana-input-model, ardana-installer-ui, ardana-ironic, ardana-keystone, ardana-logging, ardana-magnum, ardana-monasca, ardana-mq, ardana-neutron, ardana-nova, ardana-octavia, ardana-opsconsole, ardana-opsconsole-ui, ardana-osconfig, ardana-service, ardana-ses, ardana-swift, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, java-monasca-common, java-monasca-common-kit, openstack-ceilometer, openstack-cinder, openstack-designate, openstack-heat, openstack-horizon-plugin-neutron-fwaas-ui, openstack-horizon-plugin-neutron-lbaas-ui, openstack-horizon-plugin-neutron-vpnaas-ui, openstack-ironic, openstack-ironic-python-agent, openstack-keystone, openstack-magnum, openstack-manila, openstack-monasca-notification, openstack-monasca-persister, openstack-monasca-persister-java, openstack-monasca-persister-java-kit, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, openstack-tempest, python-ardana-configurationprocessor, python-cinder-tempest-plugin, python-ironicclient, python-keystonemiddleware, python-monasca-tempest-plugin, python-openstackclient, python-openstacksdk, python-proliantutils, python-python-engineio, python-swiftlm, python-vmware-nsx, python-vmware-nsxlib, yast2-crowbar (Moderate)
    2019-09-18
    oval:org.opensuse.security:def:87983
    P
    		Security update for ardana-ansible, ardana-barbican, ardana-cinder, ardana-cluster, ardana-cobbler, ardana-db, ardana-designate, ardana-extensions-nsx, ardana-glance, ardana-heat, ardana-horizon, ardana-input-model, ardana-installer-ui, ardana-ironic, ardana-keystone, ardana-logging, ardana-magnum, ardana-monasca, ardana-mq, ardana-neutron, ardana-nova, ardana-octavia, ardana-opsconsole, ardana-opsconsole-ui, ardana-osconfig, ardana-service, ardana-ses, ardana-swift, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, java-monasca-common, java-monasca-common-kit, openstack-ceilometer, openstack-cinder, openstack-designate, openstack-heat, openstack-horizon-plugin-neutron-fwaas-ui, openstack-horizon-plugin-neutron-lbaas-ui, openstack-horizon-plugin-neutron-vpnaas-ui, openstack-ironic, openstack-ironic-python-agent, openstack-keystone, openstack-magnum, openstack-manila, openstack-monasca-notification, openstack-monasca-persister, openstack-monasca-persister-java, openstack-monasca-persister-java-kit, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, openstack-tempest, python-ardana-configurationprocessor, python-cinder-tempest-plugin, python-ironicclient, python-keystonemiddleware, python-monasca-tempest-plugin, python-openstackclient, python-openstacksdk, python-proliantutils, python-python-engineio, python-swiftlm, python-vmware-nsx, python-vmware-nsxlib, yast2-crowbar (Moderate)
    2019-09-18
    oval:com.ubuntu.bionic:def:2019136110000000
    V
    		CVE-2019-13611 on Ubuntu 18.04 LTS (bionic) - low.
    2019-07-16
    oval:com.ubuntu.disco:def:2019136110000000
    V
    		CVE-2019-13611 on Ubuntu 19.04 (disco) - low.
    2019-07-16
    BACK
    python-engineio_project python-engineio *
    python-engineio_project python-engineio 3.8.2