HTML Injection Vulnerability in Twisted Framework by Twisted Matrix Laboratories
CVE-2024-41810

6.1MEDIUM

Key Information:

Vendor

Twisted

Status
Twisted
Vendor
CVE Published:
29 July 2024

What is CVE-2024-41810?

Twisted, an event-based framework for internet applications supporting Python 3.6+, is vulnerable to an HTML injection issue stemming from the twisted.web.util.redirectTo function. This vulnerability arises when application code permits an attacker to manipulate the redirect URL, potentially allowing for Reflected Cross-Site Scripting (XSS) in the redirect response's HTML body. The issue has been addressed in version 24.7.0rc1, making it crucial for users to update and safeguard their applications.

Affected Version(s)

twisted <= 24.3.0

References

https://github.com/twisted/twisted/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/twisted/twisted/commit/046a164f89a0f08...
x_refsource_MISC

EPSS Score

67% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.