CVE-2022-21712

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-346

Affected software

Vendor	Product	Versions
twisted	twisted	>= 11.1.0, < 22.1.0

References

https://github.com/twisted/twisted/commit/af8fe78542a6f2bf2235ccee8158d9c88d31e8e2Patch, Third Party Advisory
https://github.com/twisted/twisted/releases/tag/twisted-22.1.0Release Notes, Third Party Advisory
https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvxThird Party Advisory
https://github.com/twisted/twisted/commit/af8fe78542a6f2bf2235ccee8158d9c88d31e8e2Patch, Third Party Advisory
https://github.com/twisted/twisted/releases/tag/twisted-22.1.0Release Notes, Third Party Advisory
https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvxThird Party Advisory
https://lists.debian.org/debian-lts-announce/2022/02/msg00021.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLKHA6WREIVAMBQD7KKWYHPHGGNKMAG6/
https://security.gentoo.org/glsa/202301-02

Timeline

Published: Feb 7, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-217134.3Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not CVE-2022-217156.1CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\CVE-2022-217167.5Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implem CVE-2022-217185.0Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to CVE-2022-217196.1GLPI is a free asset and IT management software package. All GLPI versions prior to 9.5.7 are vulnerable to reflected cross-site scripting. CVE-2022-21724.3The LinkWorth WordPress plugin before 3.3.4 does not implement nonce checks, which could allow attackers to make a logged in admin change se CVE-2022-217204.9GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally i CVE-2022-217217.5Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9, vulnerable code could allow a bad actor to trigger a CVE-2022-217229.1PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SD CVE-2022-217239.1PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SD CVE-2022-217249.8pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security rese CVE-2022-217256.5Tensorflow is an Open Source Machine Learning Framework. The estimator for the cost of some convolution operations can be made to execute a