CVE-2019-12387

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00030.htmlBroken Link
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00042.htmlBroken Link
https://github.com/twisted/twisted/commit/6c61fc4503ae39ab8ecee52d10f10ee2c371d7e2Patch, Third Party Advisory
https://labs.twistedmatrix.com/2019/06/twisted-1921-released.htmlExploit, Release Notes, Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2G5RPDQ4BNB336HL6WW5ZJ344MAWNN7N/
https://twistedmatrix.com/pipermail/twisted-python/2019-June/032352.htmlExploit, Release Notes, Vendor Advisory
https://usn.ubuntu.com/4308-1/Third Party Advisory
https://usn.ubuntu.com/4308-2/Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.htmlPatch, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00030.htmlBroken Link
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00042.htmlBroken Link
https://github.com/twisted/twisted/commit/6c61fc4503ae39ab8ecee52d10f10ee2c371d7e2Patch, Third Party Advisory
https://labs.twistedmatrix.com/2019/06/twisted-1921-released.htmlExploit, Release Notes, Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2G5RPDQ4BNB336HL6WW5ZJ344MAWNN7N/
https://twistedmatrix.com/pipermail/twisted-python/2019-June/032352.htmlExploit, Release Notes, Vendor Advisory
https://usn.ubuntu.com/4308-1/Third Party Advisory
https://usn.ubuntu.com/4308-2/Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.htmlPatch, Third Party Advisory

Timeline

Published: Jun 10, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-123887.5Anviz access control devices perform cleartext transmission of sensitive information (passwords/pins and names) when replying to query on po CVE-2019-123897.5Anviz access control devices expose credentials (names and passwords) by allowing remote attackers to query this information without credent CVE-2019-12397.5A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execut CVE-2019-123905.3Anviz access control devices expose private Information (pin code and name) by allowing remote attackers to query this information without c CVE-2019-123917.5The Anviz Management System for access control has insufficient logging for device events such as door open requests.CVE-2019-123929.8Anviz access control devices allow remote attackers to issue commands without a password.CVE-2019-123937.5Anviz access control devices are vulnerable to replay attacks which could allow attackers to intercept and replay open door requests.CVE-2019-123949.8Anviz access control devices allow unverified password change which allows remote attackers to change the administrator password without pri CVE-2019-123955.3In Webbukkit Dynmap 3.0-beta-3 or below, due to a missing login check in servlet/MapStorageHandler.java, an attacker can see a map image wit CVE-2019-123976.1Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version CVE-2019-123984.8In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow me CVE-2019-123997.5When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, an