Every CVESearch/Get API key

CVE-2020-11728

An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Session management...

7.5 HighFix available

An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone who can guess the microsecond time (and the incrementing session_id) can impersonate a session.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

1.59%Up 0.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used7.5

An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone who can guess the microsecond time (and the incrementing session_id) can impersonate a session.

Record
CVE-2020-11728
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-384
Updated
2026-11-02
CVE ListNo score

An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone who can guess the microsecond time (and the incrementing session_id) can impersonate a session.

Record
CVE-2020-11728
Updated
2026-11-02
EUVDEUVD-2020-4070No score

An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone who can guess the microsecond time (and the incrementing session_id) can impersonate a session.

Record
EUVD-2020-4070
Updated
2026-11-03
GitHub AdvisoriesGHSA-gqhq-jmhf-8j847.5

An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Session management...

An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone who can guess the microsecond time (and the incrementing session_id) can impersonate a session.

Record
GHSA-gqhq-jmhf-8j84
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-384
Updated
2026-11-02
OSV7.5

An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone who can guess the microsecond time (and the incrementing session_id) can impersonate a session.

Record
CVE-2020-11728
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2020-117287.5

An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone who can guess the microsecond time (and the incrementing session_id) can impersonate a session.

Record
DEBIAN-CVE-2020-11728
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2020-117287.5

An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone who can guess the microsecond time (and the incrementing session_id) can impersonate a session.

Record
UBUNTU-CVE-2020-11728
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-12
OSVUSN-4539-1No score

awl vulnerability

Andrew Bartlett discovered that DAViCal Andrew's Web Libraries (AWL) did not properly manage session keys. An attacker could possibly use this issue to impersonate a session. (CVE-2020-11728)

Record
USN-4539-1
Updated
2026-11-02
OSVUSN-9048-1No score

awl vulnerabilities

Andrew Bartlett discovered that AWL did not properly generate session keys. A remote attacker could possibly use this issue to guess a session key and impersonate another user's session. (CVE-2020-11728)

It was discovered that AWL did not securely generate long-term session cookies. A remote attacker could possibly use this issue to guess a session cookie through a brute-force attack and gain access to another user's session. (CVE-2020-11729)

Record
USN-9048-1
Updated
2026-11-12

Affected products

Affected packages

Affected packages
PackageAffectedFixed
awl
Debian:12
before 0.61-1
0.61-1
awl
Debian:13
before 0.61-1
0.61-1
awl
Debian:14
before 0.61-1
0.61-1
awl
Debian:8
From an advisory covering 2 CVEs
before 0.55-1+deb8u1, plus listed versions
0.55-1
0.55-1+deb8u1
awl
Debian:9
From an advisory covering 2 CVEs
before 0.57-1+deb9u1, plus listed versions
0.57-1
0.57-1+deb9u1
awl
Debian:10
From an advisory covering 2 CVEs
before 0.60-1+deb10u1, plus listed versions
0.60-10.60-1+deb10u1~bpo9+1
0.60-1+deb10u1
awl
Ubuntu:Pro:16.04:LTS
before 0.56-1ubuntu1+esm1, plus listed versions
0.55-10.56-10.56-1ubuntu1
0.56-1ubuntu1+esm1
awl
Ubuntu:Pro:18.04:LTS
before 0.59-1ubuntu0.1~esm1, plus listed versions
0.57-10.58-10.59-1
0.59-1ubuntu0.1~esm1
awl
Ubuntu:20.04:LTS
before 0.60-1+deb10u1ubuntu1, plus listed versions
0.60-1
0.60-1+deb10u1ubuntu1
awl
Ubuntu:Pro:16.04:LTS
From an advisory covering 2 CVEs
before 0.56-1ubuntu1+esm1, plus listed versions
0.55-10.56-10.56-1ubuntu1
0.56-1ubuntu1+esm1
awl
Ubuntu:Pro:18.04:LTS
From an advisory covering 2 CVEs
before 0.59-1ubuntu0.1~esm1, plus listed versions
0.57-10.58-10.59-1
0.59-1ubuntu0.1~esm1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-11728 is a high vulnerability (CVSS 7.5) in Davical Andrew\'s Web Libraries, published April 15, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.59%, the 75th percentile. Fixed in awl 0.61-1.

References

Show 8 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open