PT-2022-4889 · Twisted+5 · Twisted+5

Alex + 2 · Published 2022-01-23 · Updated 2025-09-22 · CVE-2022-21712

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Twisted (affected versions not specified)

Description The issue is related to the exposure of cookies and authorization headers when following cross-origin redirects. This problem is present in the twisted.web.RedirectAgent and twisted.web.BrowserLikeRedirectAgent functions. The vulnerability allows a remote attacker to access confidential data.

Recommendations As a temporary workaround, consider disabling the twisted.web.RedirectAgent and twisted.web.BrowserLikeRedirectAgent functions until a patch is available. Users are advised to upgrade to a newer version to resolve the issue. At the moment, there is no information about a specific newer version that contains a fix for this vulnerability.

Exploit

Fix

Origin Validation Error

Information Disclosure

Weakness Enumeration

CWE-346

CWE-200

Related Identifiers

AZL-8505

BDU:2022-06046

CVE-2022-21712

DLA-2927-1

GHSA-92X2-JW7W-XVVX

MGASA-2022-0168

OESA-2023-1908

OESA-2023-1909

OESA-2023-1970

OPENSUSE-SU-2022:0499-1

OPENSUSE-SU-2022_0499-1

OPENSUSE-SU-2024:11841-1

PYSEC-2022-27

RHSA-2022:0982

RHSA-2022:0992

SUSE-SU-2022:0499-1

SUSE-SU-2022:0734-1

SUSE-SU-2022:4074-1

SUSE-SU-2022_0499-1

SUSE-SU-2022_0734-1

USN-5354-1

Affected Products

Astra Linux

Linuxmint

Red Os

Suse

Twisted

Ubuntu

References · 73

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21712.json · Exploit
• https://github.com/twisted/twisted/commit/af8fe78542a6f2bf2235ccee8158d9c88d31e8e2 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2022:0499-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1970 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K · Vendor Advisory
• https://security.gentoo.org/glsa/202301-02 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-21712 · Security Note
• https://ubuntu.com/security/CVE-2022-21712 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0168.html · Security Note
• https://osv.dev/vulnerability/OESA-2023-1908 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLKHA6WREIVAMBQD7KKWYHPHGGNKMAG6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21712 · Security Note
• https://ubuntu.com/security/CVE-2022-21716 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06046 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory