Lucene search
Veracode Vulnerability DatabaseVERACODE:37702HistoryOct 27, 2022 - 6:16 a.m.
Cross-Site Scripting (XSS)
2022-10-2706:16:55
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
14
twisted
cross-site scripting
vulnerable
html
scripts
namevirtualhost
EPSS
0.002
Percentile
52.1%
twisted is vulnerable to cross-site scripting. The vulnerability is due to the function _getResourceForRequest in vhost.py. When the host header does not match the configured twisted.web.vhost.NameVirtualHost, the 404 page will render the header allowing an attacker to inject and execute HTML and scripts.
References
github.com/twisted/twisted/commit/f2f5e81c03f14e253e85fe457e646130780db40b
github.com/twisted/twisted/commit/f49041bb67792506d85aeda9cf6157e92f8048f4
github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647
lists.debian.org/debian-lts-announce/2022/11/msg00038.html
security.gentoo.org/glsa/202301-02
Related
prion
prion
Code injection
2022-10-26 20:15:00
nessus
nessus
Debian DLA-3212-1 : twisted - LTS security update
2022-11-28 00:00:00
Amazon Linux 2 : python-twisted-web (ALAS-2023-2008)
2023-04-05 00:00:00
SUSE SLES15 Security Update : python-Twisted (SUSE-SU-2022:4000-1)
2022-11-16 00:00:00
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2022:4000-1)
2022-11-16 00:00:00
SUSE: Security Advisory (SUSE-SU-2022:4057-1)
2022-11-18 00:00:00
Debian: Security Advisory (DLA-3212-1)
2022-11-29 00:00:00
cvelist
cvelist
CVE-2022-39348 Twisted vulnerable to NameVirtualHost Host header injection
2022-10-26 00:00:00
ubuntucve
ubuntucve
CVE-2022-39348
2022-10-26 00:00:00
osv
osv
twisted - security update
2022-11-28 00:00:00
CVE-2022-39348
2022-10-26 20:15:10
python-Twisted-doc-22.10.0-1.1 on GA media
2024-06-15 00:00:00
nvd
nvd
CVE-2022-39348
2022-10-26 20:15:10
github
github
Twisted vulnerable to NameVirtualHost Host header injection
2022-10-26 22:08:39
debiancve
debiancve
CVE-2022-39348
2022-10-26 20:15:10
cve
cve
CVE-2022-39348
2022-10-26 20:15:10
amazon
amazon
Medium: python-twisted-web
2023-03-30 18:56:00
Important: python-twisted-web
2023-03-30 22:50:00
mageia
mageia
Updated python-twisted packages fix security vulnerability
2023-02-27 23:27:16
redhatcve
redhatcve
CVE-2022-39348
2022-11-02 14:26:24
debian
debian
[SECURITY] [DLA 3212-1] twisted security update
2022-11-28 15:38:46
cbl_mariner
cbl_mariner
CVE-2022-39348 affecting package python-twisted 20.3.0-4
2024-09-30 09:32:20
ibm
ibm
ubuntu
ubuntu
Twisted vulnerabilities
2024-01-10 00:00:00
gentoo
gentoo
Twisted: Multiple Vulnerabilities
2023-01-11 00:00:00