Description

twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.

Remediation

References

CVE-2022-21712

Related Vulnerabilities

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-37674)

WordPress Plugin Watu Quiz Cross-Site Scripting (3.3.9.2)

PostgreSQL Heap-based Buffer Overflow Vulnerability (CVE-2026-2007)

Python Improper Restriction of XML External Entity Reference Vulnerability (CVE-2022-48565)

Handlebars Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2026-33938)

Severity

High

Classification

CVE-2022-21712 CWE-200 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities