CVE-2022-39348mediumCWE-79CWE-80

CVE-2022-39348: falha de média gravidade em twisted

Twisted vulnerable to NameVirtualHost Host header injection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar twisted+ Monitorar twisted

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.4epss 1.6%
Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
twisted · twisted
CVEs relacionadas — twisted

No mesmo produto, das mais perigosas para as menos.

CVE-2022-21716HIGHBuffer Overflow in TwistedEPSS 3.5%CVE-2022-24801HIGHHTTP Request Smuggling in twisted.webEPSS 2.8%CVE-2022-21712HIGHCookie and header exposure in twistedEPSS 1.4%CVE-2024-41810MEDIUMHTML injection in HTTP redirect bodyEPSS 1.2%CVE-2023-46137MEDIUMtwisted.web has disordered HTTP pipeline responseEPSS 0.9%CVE-2024-41671HIGHtwisted.web has disordered HTTP pipeline responseEPSS 0.9%