CVE-2022-39348

MEDIUM
Published Oct 26, 20223y ago · Modified Jun 17, 20262w ago
5.4 CVSS 3.1
Medium
Find Similar
Published Oct 26, 2022 3y ago
Last Modified Jun 17, 2026 2w ago

Description

Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.

CVSS Details

Base Score
5.4
Exploitability
2.3
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-79 Cross-site Scripting Injection
CWE-80

Affected Products 2

VendorProductVersionRange
twistedtwisted*≥0.9.4  –  <22.10.0
debiandebian_linux10.0any

References 6

  • github.com https://github.com/twisted/twisted/commit/f2f5e81c03f14e253e85fe457e646130780db40b
    Patch
  • github.com https://github.com/twisted/twisted/commit/f49041bb67792506d85aeda9cf6157e92f8048f4
    Patch
  • github.com https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647
    ExploitPatchThird Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2022/11/msg00038.html
    Mailing ListThird Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2024/11/msg00028.html
  • security.gentoo.org https://security.gentoo.org/glsa/202301-02
    Third Party Advisory

Remediation

  • github.com https://github.com/twisted/twisted/commit/f2f5e81c03f14e253e85fe457e646130780db40b
    Patch
  • github.com https://github.com/twisted/twisted/commit/f49041bb67792506d85aeda9cf6157e92f8048f4
    Patch
  • github.com https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647
    ExploitPatchThird Party Advisory