CVE-2022-21712highCWE-200

CVE-2022-21712: fallo de gravedad alta en twisted

Cookie and header exposure in twisted

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear twisted+ Monitorear twisted

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 1.4%
twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
twisted · twisted
CVEs relacionadas — twisted

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-21716HIGHBuffer Overflow in TwistedEPSS 3.5%CVE-2022-24801HIGHHTTP Request Smuggling in twisted.webEPSS 2.8%CVE-2022-39348MEDIUMTwisted vulnerable to NameVirtualHost Host header injectionEPSS 1.6%CVE-2024-41810MEDIUMHTML injection in HTTP redirect bodyEPSS 1.2%CVE-2023-46137MEDIUMtwisted.web has disordered HTTP pipeline responseEPSS 0.9%CVE-2024-41671HIGHtwisted.web has disordered HTTP pipeline responseEPSS 0.9%