Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-fwsz-6xmd-aygy
Summary
### Impact

The use of `Plug.Session` in `Pow.Plug.Session` is susceptible to session
fixation attacks if a persistent session store is used for `Plug.Session`,
such as Redis or a database. Cookie store, which is used in most Phoenix
apps, doesn't have this vulnerability.

### Workarounds

Call `Plug.Conn.configure_session(conn, renew: true)` periodically and after
privilege change. A custom authorization plug can be written where the
`create/3` method should return the conn only after
`Plug.Conn.configure_session/2` have been called on it.

### References

https://github.com/danschultzer/pow/commit/578ffd3d8bb8e8a26077b644222186b108da474f
https://www.owasp.org/index.php/Session_fixation
Aliases
0
alias CVE-2020-5205
1
alias GHSA-v2wf-c3j6-wpvw
Fixed_packages
0
url pkg:hex/pow@1.0.16
purl pkg:hex/pow@1.0.16
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@1.0.16
Affected_packages
0
url pkg:hex/pow@0.1.0-alpha
purl pkg:hex/pow@0.1.0-alpha
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@0.1.0-alpha
1
url pkg:hex/pow@0.1.0-alpha.1
purl pkg:hex/pow@0.1.0-alpha.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@0.1.0-alpha.1
2
url pkg:hex/pow@0.1.0-alpha.2
purl pkg:hex/pow@0.1.0-alpha.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@0.1.0-alpha.2
3
url pkg:hex/pow@0.1.0-alpha.3
purl pkg:hex/pow@0.1.0-alpha.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@0.1.0-alpha.3
4
url pkg:hex/pow@0.1.0-alpha.4
purl pkg:hex/pow@0.1.0-alpha.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@0.1.0-alpha.4
5
url pkg:hex/pow@0.1.0-alpha.5
purl pkg:hex/pow@0.1.0-alpha.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@0.1.0-alpha.5
6
url pkg:hex/pow@0.1.0-alpha.6
purl pkg:hex/pow@0.1.0-alpha.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@0.1.0-alpha.6
7
url pkg:hex/pow@0.1.0-alpha.7
purl pkg:hex/pow@0.1.0-alpha.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@0.1.0-alpha.7
8
url pkg:hex/pow@0.1.0-alpha.8
purl pkg:hex/pow@0.1.0-alpha.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@0.1.0-alpha.8
9
url pkg:hex/pow@0.1.0-rc.1
purl pkg:hex/pow@0.1.0-rc.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@0.1.0-rc.1
10
url pkg:hex/pow@1.0.0-rc.0
purl pkg:hex/pow@1.0.0-rc.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@1.0.0-rc.0
11
url pkg:hex/pow@1.0.0-rc.1
purl pkg:hex/pow@1.0.0-rc.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@1.0.0-rc.1
12
url pkg:hex/pow@1.0.0-rc.2
purl pkg:hex/pow@1.0.0-rc.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@1.0.0-rc.2
13
url pkg:hex/pow@1.0.0-rc.3
purl pkg:hex/pow@1.0.0-rc.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@1.0.0-rc.3
14
url pkg:hex/pow@1.0.0-rc.4
purl pkg:hex/pow@1.0.0-rc.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@1.0.0-rc.4
15
url pkg:hex/pow@1.0.0
purl pkg:hex/pow@1.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@1.0.0
16
url pkg:hex/pow@1.0.1
purl pkg:hex/pow@1.0.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@1.0.1
17
url pkg:hex/pow@1.0.2
purl pkg:hex/pow@1.0.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@1.0.2
18
url pkg:hex/pow@1.0.3
purl pkg:hex/pow@1.0.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@1.0.3
19
url pkg:hex/pow@1.0.4
purl pkg:hex/pow@1.0.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@1.0.4
20
url pkg:hex/pow@1.0.5
purl pkg:hex/pow@1.0.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@1.0.5
21
url pkg:hex/pow@1.0.6
purl pkg:hex/pow@1.0.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@1.0.6
22
url pkg:hex/pow@1.0.7
purl pkg:hex/pow@1.0.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@1.0.7
23
url pkg:hex/pow@1.0.8
purl pkg:hex/pow@1.0.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@1.0.8
24
url pkg:hex/pow@1.0.9
purl pkg:hex/pow@1.0.9
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@1.0.9
25
url pkg:hex/pow@1.0.10
purl pkg:hex/pow@1.0.10
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@1.0.10
26
url pkg:hex/pow@1.0.11
purl pkg:hex/pow@1.0.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@1.0.11
27
url pkg:hex/pow@1.0.12
purl pkg:hex/pow@1.0.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@1.0.12
28
url pkg:hex/pow@1.0.13
purl pkg:hex/pow@1.0.13
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@1.0.13
29
url pkg:hex/pow@1.0.14
purl pkg:hex/pow@1.0.14
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@1.0.14
30
url pkg:hex/pow@1.0.15
purl pkg:hex/pow@1.0.15
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwsz-6xmd-aygy
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow@1.0.15
References
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2020-5205
reference_id
reference_type
scores
0
value 0.00302
scoring_system epss
scoring_elements 0.53968
published_at 2026-06-11T12:55:00Z
1
value 0.00302
scoring_system epss
scoring_elements 0.54094
published_at 2026-06-12T12:55:00Z
2
value 0.00302
scoring_system epss
scoring_elements 0.54112
published_at 2026-06-13T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2020-5205
1
reference_url https://github.com/danschultzer/pow
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/danschultzer/pow
2
reference_url https://github.com/danschultzer/pow/blob/master/CHANGELOG.md#v1016-2020-01-07
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/danschultzer/pow/blob/master/CHANGELOG.md#v1016-2020-01-07
3
reference_url https://github.com/danschultzer/pow/commit/578ffd3d8bb8e8a26077b644222186b108da474f
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/danschultzer/pow/commit/578ffd3d8bb8e8a26077b644222186b108da474f
4
reference_url https://github.com/danschultzer/pow/security/advisories/GHSA-v2wf-c3j6-wpvw
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/danschultzer/pow/security/advisories/GHSA-v2wf-c3j6-wpvw
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2020-5205
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2020-5205
Weaknesses
0
cwe_id 384
name Session Fixation
description Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Exploits
Severity_range_score4.0 - 6.9
Exploitability0.5
Weighted_severity6.2
Risk_score3.1
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-fwsz-6xmd-aygy