CVE-2016-1000111 – twisted

Package

Manager: pip
Name: twisted
Vulnerable Version: >=0 <16.3.1

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS: 0.00584 pctl0.68072

Details

Forced Browsing in Twisted Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the `HTTP_PROXY` environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an `httpoxy` issue.

Metadata

Created: 2021-04-30T17:32:28Z
Modified: 2024-11-18T22:24:19Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-3gqj-cmxr-p4x2/GHSA-3gqj-cmxr-p4x2.json
CWE IDs: ["CWE-425"]
Alternative ID: GHSA-3gqj-cmxr-p4x2
Finding: F100
Auto approve: 1