CVE-2023-49082
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
The vulnerability in aiohttp allows an attacker to modify the HTTP request through improper validation, potentially leading to header injection or the creation of new requests if the attacker controls the HTTP method.
Risk Assessment
Organizations may be exposed to request smuggling attacks, which could lead to unauthorized access or data manipulation.
Recommendation
It is recommended to upgrade to version 3.9.0 or later to mitigate this vulnerability.
Original NVD description (English source)
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.