Lucene search

GitHub_MCVE-2022-21712

HistoryFeb 07, 2022 - 10:15 p.m.

CVE-2022-21712

2022-02-0722:15:08

CWE-200

CWE-346

GitHub_M

web.nvd.nist.gov

211

twisted

event-driven networking

python

cve-2022-21712

security vulnerability

authorization headers

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.2

Confidence

High

EPSS

0.005

Percentile

77.0%

JSON

twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the twited.web.RedirectAgent and twisted.web. BrowserLikeRedirectAgent functions. Users are advised to upgrade. There are no known workarounds.

Affected configurations

Nvd

Vulners

Node

twistedmatrixtwistedRange11.1.0–22.1.0

Node

debiandebian_linuxMatch9.0

Node

fedoraprojectfedoraMatch35

fedoraprojectfedoraMatch36

VendorProductVersionCPE
twistedmatrixtwisted*cpe:2.3:a:twistedmatrix:twisted:*:*:*:*:*:*:*:*
debiandebian_linux9.0cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
fedoraprojectfedora35cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
fedoraprojectfedora36cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
twistedmatrix	twisted	*	cpe:2.3:a:twistedmatrix:twisted::::::::
debian	debian_linux	9.0	cpe:2.3:o:debian:debian_linux:9.0:::::::*
fedoraproject	fedora	35	cpe:2.3:o:fedoraproject:fedora:35:::::::*
fedoraproject	fedora	36	cpe:2.3:o:fedoraproject:fedora:36:::::::*

CNA Affected

[
  {
    "vendor": "twisted",
    "product": "twisted",
    "versions": [
      {
        "version": ">= 11.1, < 22.1",
        "status": "affected"
      }
    ]
  }
]