Medium severity · published Oct 26, 2022
CVE-2022-39348
Twisted vulnerable to NameVirtualHost Host header injection
5.4
CVSS
1.6%
EPSS
No
On KEV
Description
Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TW
twisted · twisted
>= 0.9.4, < 22.10.0rc1 · source: vendor, NVD
DL
Debian Linux · Debian
10.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-39348
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-39348
Patch
https://github.com/twisted/twisted/commit/f2f5e81c03f14e253e85fe457e646130780db40b
Patch
https://github.com/twisted/twisted/commit/f49041bb67792506d85aeda9cf6157e92f8048f4
Exploit
https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647
Mailing List
https://lists.debian.org/debian-lts-announce/2022/11/msg00038.html
Third Party Advisory
https://security.gentoo.org/glsa/202301-02
lists.debian.org
https://lists.debian.org/debian-lts-announce/2024/11/msg00028.html
More from twisted
9.8
CVE-2020-10109
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability
9.8
CVE-2020-10108
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability
8.7
CVE-2026-115775
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree
8.1
CVE-2022-24801
Twisted is an event-based framework for internet applications, supporting Python 3.6+
7.5
CVE-2026-115778
Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer