Twisted vulnerable to NameVirtualHost Host header injection

...

Cross-Site Scripting (XSS)

twisted is vulnerable to cross-site scripting. The vulnerability is due to the function getResourceForRequest in vhost.py. When the host header does not match the configured twisted.web.vhost.NameVirtualHost, the 404 page will render the header allowing an attacker to inject and execute HTML and...

Twisted vulnerable to NameVirtualHost Host header injection

When the host header does not match a configured host, twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. Example configuration: python from twisted.web.server import Site from...

GHSA-VG46-2RRJ-3647 Twisted vulnerable to NameVirtualHost Host header injection

When the host header does not match a configured host, twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. Example configuration: python from twisted.web.server import Site from...

AZL-11357 CVE-2022-39348 affecting package python-twisted for versions less than 22.10.0-2

Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and scri...

DEBIAN-CVE-2022-39348

Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and scri...

CVE-2022-39348

Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and scri...

CVE-2022-39348

Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and scri...

Code injection

Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and scri...

UBUNTU-CVE-2022-39348

Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and scri...

PT-2022-7596

Name of the Vulnerable Software and Affected Versions Twisted versions 0.9.4 through 22.10.0rc1 Description The issue is related to the Twisted event-based framework for internet applications. When the host header does not match a configured host, twisted.web.vhost.NameVirtualHost will return a...

CVE-2022-39348

CVE-2022-39348 (Twisted) affects the Twisted event-based framework for internet applications. When the host header does not match a configured host (twisted.web.vhost.NameVirtualHost), NoResource is returned and the Host header is unescaped in the 404, enabling HTML and script injection. The issu...

Twisted 跨站脚本漏洞

Twisted is an event-driven open source web engine written in Python. A security vulnerability exists in Twisted versions 0.9.4 through 22.10.0rc1, which stems from the fact that when the host header does not match the configured host, "twisted.web.vhost. "NoResource" resource that unescapes the...

CVE-2022-39348 Twisted vulnerable to NameVirtualHost Host header injection

Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and scri...

CVE-2022-39348 Twisted vulnerable to NameVirtualHost Host header injection

Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and scri...

CVE-2022-39348 Twisted vulnerable to NameVirtualHost Host header injection

Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and scri...

CVE-2022-39348

Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and scri...

Twisted vulnerable to HTTP Request Smuggling Attacks

Impact Twisted Web is vulnerable to request smuggling attacks: 1. "When presented with two content-length headers, Twisted Web ignored the first header. When the second content-length was set to zero this caused Twisted Web to interpret the request body as a pipelined request. According to RFC 72...

GHSA-8R99-H8J2-RW64 Twisted vulnerable to HTTP Request Smuggling Attacks

Impact Twisted Web is vulnerable to request smuggling attacks: 1. "When presented with two content-length headers, Twisted Web ignored the first header. When the second content-length was set to zero this caused Twisted Web to interpret the request body as a pipelined request. According to RFC 72...

PT-2022-28224 · Unknown · Twisted Web

Name of the Vulnerable Software and Affected Versions: Twisted Web affected versions not specified Description: The issue allows for request smuggling attacks. When Twisted Web receives a request with two content-length headers, it ignores the first header. If the second content-length is set to...