GitHub Advisoryadvisory · PyPI

GHSA-92x2-jw7w-xvvx Cookie and header exposure in twisted

HIGH Published 2022-02-07 Modified 2024-11-25 Official page ↗
Aliases
CVE-2022-21712
Ecosystem
PyPI
Packages
Twisted
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-346
Reviewed
2022-02-07

Affected packages

• PyPI Twisted: >= 11.1.0, < 22.1.0 → fixed in 22.1.0

Description

Impact Cookie and Authorization headers are leaked when following cross-origin redirects in `twited.web.client.RedirectAgent` and `twisted.web.client.BrowserLikeRedirectAgent`.

Related

Alias · CVE (1)

  • CVE-2022-21712 twisted is an event-driven networking engine written in Python. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-346 Origin Validation Error weakness

References