Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Twisted Web HTTP Server Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2022-39348 - Vulnerability Database
Twisted Web HTTP Server

Twisted Web HTTP Server Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2022-39348

Medium
Reference: CVE-2022-39348
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2022-39348
Title: Twisted Web HTTP Server Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Overview:

Twisted is an event-based framework for internet applications. Started with version 0.9.4 when the host header does not match a configured host twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.