CVE-2020-35678

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Autobahn|Python before 20.12.3 allows redirect header injection.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://autobahn.readthedocs.io/en/latest/changelog.htmlRelease Notes, Vendor Advisory
https://github.com/crossbario/autobahn-pythonProduct, Third Party Advisory
https://github.com/crossbario/autobahn-python/compare/v20.12.2...v20.12.3Patch, Third Party Advisory
https://github.com/crossbario/autobahn-python/pull/1439Patch, Third Party Advisory
https://pypi.org/project/autobahn/20.12.3/Product, Third Party Advisory
https://autobahn.readthedocs.io/en/latest/changelog.htmlRelease Notes, Vendor Advisory
https://github.com/crossbario/autobahn-pythonProduct, Third Party Advisory
https://github.com/crossbario/autobahn-python/compare/v20.12.2...v20.12.3Patch, Third Party Advisory
https://github.com/crossbario/autobahn-python/pull/1439Patch, Third Party Advisory
https://pypi.org/project/autobahn/20.12.3/Product, Third Party Advisory

Timeline

Published: Dec 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-356797.5smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak v CVE-2020-35685.8A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unau CVE-2020-356807.5smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to cause a denial of service (NULL pointe CVE-2020-356817.4Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels CVE-2020-356828.8Zoho ManageEngine ServiceDesk Plus before 11134 allows an Authentication Bypass (only during SAML login).CVE-2020-356837.5An issue was discovered in HCC Nichestack 3.0. The code that parses ICMP packets relies on an unchecked value of the IP payload size (extrac CVE-2020-356847.5An issue was discovered in HCC Nichestack 3.0. The code that parses TCP packets relies on an unchecked value of the IP payload size (extract CVE-2020-356859.1An issue was discovered in HCC Nichestack 3.0. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN f CVE-2020-356867.8The SECOMN service in Sound Research DCHU model software component modules (APO) through 2.0.9.17, delivered on HP Windows 10 computers, may CVE-2020-356874.3PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the log CVE-2020-35698.6Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthent CVE-2020-356938.8On some Samsung phones and tablets running Android through 7.1.1, it is possible for an attacker-controlled Bluetooth Low Energy (BLE) devic