CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2022-21712
High (7.5). EPSS 1.4% chance of exploitation in the next 30 days. Fixed in twisted 22.1.0.
twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.
Severity
- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-200, CWE-346
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- fedoraproject:fedora
- twisted:twisted
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-92x2-jw7w-xvvx | PyPI | twisted | >=11.1.0 <22.1.0 | 22.1.0 |
| PYSEC-2022-27 | PyPI | twisted | >=11.1.0 <22.1.0 | 22.1.0 |
References
- https://github.com/twisted/twisted/commit/af8fe78542a6f2bf2235ccee8158d9c88d31e8e2
- https://github.com/twisted/twisted/releases/tag/twisted-22.1.0
- https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvx
- https://github.com/twisted/twisted/commit/af8fe78542a6f2bf2235ccee8158d9c88d31e8e2
- https://github.com/twisted/twisted/releases/tag/twisted-22.1.0