CVE-2024-41810mediumCWE-79CWE-80

CVE-2024-41810: medium-severity vulnerability in twisted

HTML injection in HTTP redirect body

Published · Updated

Follow this CVE+ Monitor twisted+ Monitor twisted

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 6.1epss 1.2%
Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
twisted · twisted
Related CVEs — twisted

In the same product, most dangerous first.

CVE-2022-21716HIGHBuffer Overflow in TwistedEPSS 3.5%CVE-2022-24801HIGHHTTP Request Smuggling in twisted.webEPSS 2.8%CVE-2022-39348MEDIUMTwisted vulnerable to NameVirtualHost Host header injectionEPSS 1.6%CVE-2022-21712HIGHCookie and header exposure in twistedEPSS 1.4%CVE-2023-46137MEDIUMtwisted.web has disordered HTTP pipeline responseEPSS 0.9%CVE-2024-41671HIGHtwisted.web has disordered HTTP pipeline responseEPSS 0.9%