CVE-2024-41671
twisted.web has disordered HTTP pipeline response
Severity Score
8.3
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track*
*SSVC
Descriptions
Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track*
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-07-18 CVE Reserved
- 2024-07-29 CVE Published
- 2024-07-30 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| https://github.com/twisted/twisted/commit/046a164f89a0f08d3239ecebd750360f8914df33 | X_refsource_misc | |
| https://github.com/twisted/twisted/commit/4a930de12fb67e88fefcb8822104152f42b27abc | X_refsource_misc | |
| https://github.com/twisted/twisted/security/advisories/GHSA-c8m8-j448-xjx7 | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|