twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.
CVE-2022-21712 - High Severity Vulnerability
An asynchronous networking framework written in Python
Library home page: https://files.pythonhosted.org/packages/4d/15/890ba1d83dc29ad71427ce5174d5963b84a25c8cf1973815107709fbb520/Twisted-20.3.0-cp27-cp27mu-manylinux1_x86_64.whl
Path to dependency file: /server/requirements.txt
Path to vulnerable library: /server/requirements.txt
Dependency Hierarchy: - :x: **Twisted-20.3.0-cp27-cp27mu-manylinux1_x86_64.whl** (Vulnerable Library)
Found in base branch: master
twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.
Publish Date: 2022-02-07
URL: CVE-2022-21712
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvx
Release Date: 2022-02-07
Fix Resolution: 22.1.0
Step up your Open Source Security Game with Mend here