REDHAT-BUG-2300497: XSS
Twisted is an event-based framework for internet applications, supporting Python 3.6+. The twisted.web.util.redirectTo function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2300497?
The severity of REDHAT-BUG-2300497 is classified as a high risk due to its potential for enabling reflected cross-site scripting attacks.
How do I fix REDHAT-BUG-2300497?
To fix REDHAT-BUG-2300497, upgrade the Twisted framework to version 24.7.0 or later.
What is the impact of REDHAT-BUG-2300497?
The impact of REDHAT-BUG-2300497 includes the potential for HTML injection which could lead to unauthorized script execution in users' browsers.
Which versions of Twisted are affected by REDHAT-BUG-2300497?
Versions of Twisted prior to 24.7.0 are affected by REDHAT-BUG-2300497.
What kind of attacks can REDHAT-BUG-2300497 enable?
REDHAT-BUG-2300497 can enable reflected cross-site scripting attacks, allowing attackers to execute malicious scripts in the context of a user's session.