VULNERABILITY INTELLIGENCE
CVE-2015-2296
CVSS score6.8 MEDIUM
EPSS probability3.42%
CISA KEVNot currently listed
Published2015-03-18
Last modified2026-06-17
CVSS vectorAV:N/AC:M/Au:N/C:P/I:P/A:P
Description
The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.