{"action":"Upgrade channels to 3.0.3 or later.","affected":[{"fixed":"3.0.3","introduced":"3.0.0"}],"component":"channels","cve_ids":["CVE-2020-35681"],"ecosystem":"PyPI","epss":0.02658,"exploited":false,"fixed_versions":["3.0.3"],"ghsa_id":"GHSA-v542-8q9x-cffc","id":"tcs_01M5KGB3HAXZ8G90RRR4BATXE1","modified_at":"2023-11-08T04:03:35.366407Z","published_at":"2021-02-22T03:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-113","https://github.com/django/channels/releases","https://channels.readthedocs.io/en/stable/releases/3.0.3.html","https://channels.readthedocs.io/en/stable/releases/index.html","https://github.com/advisories/GHSA-v542-8q9x-cffc"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"PYSEC-2021-113","url":"https://osv.dev/vulnerability/PYSEC-2021-113"},{"source":"nvd","source_id":"CVE-2020-35681","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35681"}],"summary":"Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type request"}