{"id":"CVE-2024-41810","aliases":["AZL-47073","AZL-47195","CLSA-2025-1762474360","DEBIAN-CVE-2024-41810","DLA-3970-1","DSA-5797-1","EUVD-2024-0167","GHSA-cf56-g6w6-pqq2","MGASA-2025-0054","OESA-2024-1983","OESA-2024-1984","OESA-2024-1985","OESA-2024-1986","OESA-2024-2052","PYSEC-2024-75","RHSA-2024:7312","SUSE-SU-2024:2732-1","SUSE-SU-2024:2757-1","SUSE-SU-2024:2860-1","SUSE-SU-2024:2880-1","UBUNTU-CVE-2024-41810","USN-6988-1","openSUSE-SU-2024:14236-1"],"status":"published","title":"HTML injection in HTTP redirect body","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01201,"percentile":0.68454,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79","CWE-80"],"published":"2024-07-29T15:41:40Z","modified":"2026-11-05T05:40:51Z","exploits":[{"source":"nuclei","id":"CVE-2024-41810","title":"Twisted - Open Redirect \u0026 XSS","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-41810.yaml"}],"fixes":[{"ecosystem":"PyPI","package":"twisted","fixed_in":["24.7.0rc1"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"python-twisted","fixed_in":["22.10.0-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"python-twisted","fixed_in":["22.10.0-3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"twisted","fixed_in":["22.4.0-4+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"twisted","fixed_in":["24.7.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"twisted","fixed_in":["24.7.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"twisted","fixed_in":["13.2.0-1ubuntu1.2+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"twisted","fixed_in":["16.0.0-1ubuntu0.4+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"twisted","fixed_in":["17.9.0-2ubuntu0.3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"twisted","fixed_in":["18.9.0-11ubuntu0.20.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"twisted","fixed_in":["22.1.0-2ubuntu2.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"twisted","fixed_in":["24.3.0-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"24.3.0"},{"fixed":"24.7.0rc1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-3"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.3.0"},{"fixed":"20.3.0.post4+tuxcare"}]}],"versions":["20.3.0"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-4+deb12u1"}]}],"versions":["22.4.0-4"]},{"source":"osv","ecosystem":"Debian:13","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.7.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.7.0-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.3.0-7+deb11u2"}]}],"versions":["20.3.0-7","20.3.0-7+deb11u1"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-4+deb12u1"}]}],"versions":["22.4.0-4"],"bundled":3},{"source":"osv","ecosystem":"PyPI","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.7.0rc1"}]}],"versions":["1.0.1","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.2.0","10.0.0","10.1.0","10.2.0","11.0.0","11.1.0","12.0.0","12.1.0","12.2.0","12.3.0","13.0.0","13.1.0","13.2.0","14.0.0","14.0.1","14.0.2","15.0.0","15.1.0","15.2.0","15.2.1","15.3.0","15.4.0","15.5.0","16.0.0","16.1.0","16.1.1","16.2.0","16.3.0","16.3.1","16.3.2","16.4.0","16.4.1","16.5.0","16.5.0rc1","16.5.0rc2","16.6.0","16.6.0rc1","16.7.0rc1","16.7.0rc2","17.1.0","17.1.0rc1","17.5.0","17.9.0","17.9.0rc1","18.4.0","18.4.0rc1","18.7.0","18.7.0rc1","18.7.0rc2","18.9.0","18.9.0rc1","19.10.0","19.10.0rc1","19.2.0","19.2.0rc1","19.2.0rc2","19.2.1","19.7.0","19.7.0rc1","2.1.0","2.4.0","2.5.0","20.3.0","20.3.0rc1","21.2.0","21.2.0rc1","21.7.0","21.7.0rc1","21.7.0rc2","21.7.0rc3","22.1.0","22.1.0rc1","22.10.0","22.10.0rc1","22.2.0","22.2.0rc1","22.4.0","22.4.0rc1","22.8.0","22.8.0rc1","23.10.0","23.10.0rc1","23.8.0","23.8.0rc1","24.2.0rc1","24.3.0","8.0.0","8.0.1","8.1.0","8.2.0","9.0.0"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-2.1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-4.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-4.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-3.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-4.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-4.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"twisted","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"046a164f89a0f08d3239ecebd750360f8914df33"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.7.0rc1"}]}],"versions":["1.0.1","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.2.0","10.0.0","10.1.0","10.2.0","11.0.0","11.1.0","12.0.0","12.1.0","12.2.0","12.3.0","13.0.0","13.1.0","13.2.0","14.0.0","14.0.1","14.0.2","15.0.0","15.1.0","15.2.0","15.2.1","15.3.0","15.4.0","15.5.0","16.0.0","16.1.0","16.1.1","16.2.0","16.3.0","16.3.1","16.3.2","16.4.0","16.4.1","16.5.0","16.5.0rc1","16.5.0rc2","16.6.0","16.6.0rc1","16.7.0rc1","16.7.0rc2","17.1.0","17.1.0rc1","17.5.0","17.9.0","17.9.0rc1","18.4.0","18.4.0rc1","18.7.0","18.7.0rc1","18.7.0rc2","18.9.0","18.9.0rc1","19.10.0","19.10.0rc1","19.2.0","19.2.0rc1","19.2.0rc2","19.2.1","19.7.0","19.7.0rc1","2.1.0","2.4.0","2.5.0","20.3.0","20.3.0rc1","21.2.0","21.2.0rc1","21.7.0","21.7.0rc1","21.7.0rc2","21.7.0rc3","22.1.0","22.1.0rc1","22.10.0","22.10.0rc1","22.2.0","22.2.0rc1","22.4.0","22.4.0rc1","22.8.0","22.8.0rc1","23.10.0","23.10.0rc1","23.8.0","23.8.0rc1","24.2.0rc1","24.3.0","8.0.0","8.0.1","8.1.0","8.2.0","9.0.0"]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.12-1.el8ap"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.12-1.el9ap"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"python3-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-150400.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"python3-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-150400.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python3-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-150400.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python3-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-150400.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python3-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-150400.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python3-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-150400.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"python3-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-150400.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"python3-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-150400.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python3-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-150400.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-150400.5.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP5","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-150400.5.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-150400.5.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-150400.5.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-150400.5.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-150400.5.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-150400.5.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-150400.5.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-150400.5.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.2.0-1ubuntu1.2+esm3"}]}],"versions":["13.0.0-1ubuntu1","13.2.0-1ubuntu1","13.2.0-1ubuntu1.2","13.2.0-1ubuntu1.2+esm1","13.2.0-1ubuntu1.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.0.0-1ubuntu0.4+esm2"}]}],"versions":["15.2.1-1ubuntu2","15.5.0-1","15.5.0-2","15.5.0-2ubuntu1","15.5.0-4","16.0.0~pre1-1","16.0.0~pre1-1ubuntu1","16.0.0~pre1-2ubuntu1","16.0.0~pre1-3","16.0.0-1","16.0.0-1ubuntu0.2","16.0.0-1ubuntu0.4","16.0.0-1ubuntu0.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.9.0-2ubuntu0.3+esm1"}]}],"versions":["16.6.0-2ubuntu3","17.9.0-1","17.9.0-2","17.9.0-2ubuntu0.1","17.9.0-2ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.9.0-11ubuntu0.20.04.4"}]}],"versions":["18.9.0-3ubuntu1","18.9.0-5","18.9.0-6","18.9.0-6build1","18.9.0-6ubuntu1","18.9.0-8","18.9.0-11","18.9.0-11ubuntu0.20.04.1","18.9.0-11ubuntu0.20.04.2","18.9.0-11ubuntu0.20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.0-2ubuntu2.5"}]}],"versions":["20.3.0-7ubuntu1","20.3.0-7ubuntu3","22.1.0-2ubuntu2","22.1.0-2ubuntu2.1","22.1.0-2ubuntu2.3","22.1.0-2ubuntu2.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.3.0-1ubuntu0.1"}]}],"versions":["22.4.0-4","22.4.0-4ubuntu1","23.10.0-2","24.3.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.2.0-1ubuntu1.2+esm3"}]}],"versions":["13.0.0-1ubuntu1","13.2.0-1ubuntu1","13.2.0-1ubuntu1.2","13.2.0-1ubuntu1.2+esm1","13.2.0-1ubuntu1.2+esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.0.0-1ubuntu0.4+esm2"}]}],"versions":["15.2.1-1ubuntu2","15.5.0-1","15.5.0-2","15.5.0-2ubuntu1","15.5.0-4","16.0.0~pre1-1","16.0.0~pre1-1ubuntu1","16.0.0~pre1-2ubuntu1","16.0.0~pre1-3","16.0.0-1","16.0.0-1ubuntu0.2","16.0.0-1ubuntu0.4","16.0.0-1ubuntu0.4+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.9.0-2ubuntu0.3+esm1"}]}],"versions":["16.6.0-2ubuntu3","17.9.0-1","17.9.0-2","17.9.0-2ubuntu0.1","17.9.0-2ubuntu0.3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.9.0-11ubuntu0.20.04.4"}]}],"versions":["18.9.0-3ubuntu1","18.9.0-5","18.9.0-6","18.9.0-6build1","18.9.0-6ubuntu1","18.9.0-8","18.9.0-11","18.9.0-11ubuntu0.20.04.1","18.9.0-11ubuntu0.20.04.2","18.9.0-11ubuntu0.20.04.3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.0-2ubuntu2.5"}]}],"versions":["20.3.0-7ubuntu1","20.3.0-7ubuntu3","22.1.0-2ubuntu2","22.1.0-2ubuntu2.1","22.1.0-2ubuntu2.3","22.1.0-2ubuntu2.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.3.0-1ubuntu0.1"}]}],"versions":["22.4.0-4","22.4.0-4ubuntu1","23.10.0-2","24.3.0-1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.3.0-2.1"}]}],"bundled":2}],"products":[{"vendor":"twisted","product":"twisted"},{"vendor":"twistedmatrix","product":"twisted"}],"references":[{"url":"https://github.com/twisted/twisted/security/advisories/GHSA-cf56-g6w6-pqq2","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/twisted/twisted/commit/046a164f89a0f08d3239ecebd750360f8914df33","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","article"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00028.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41810","tags":["web","advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2024-75.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cf56-g6w6-pqq2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41810.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-41810","tags":["advisory"]},{"url":"https://github.com/twisted/twisted","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0054.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33807","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6575-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6988-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6988-2","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1983","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41671","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1984","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1985","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1986","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2052","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:7312","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2292788","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2294457","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2300497","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7312.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21520","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21520","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21520","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-37891","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-37891","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37891","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-41810","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-41810","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242732-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1228549","tags":["report"]},{"url":"https://bugzilla.suse.com/1228552","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41810","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242757-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242860-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242880-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-41810","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41671","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-41810","title":"HTML injection in HTTP redirect body","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.","status":"published","published":"2024-07-29T15:41:40.289Z","modified":"2025-11-03T22:01:01.094Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79","CWE-80"],"updated_at":"2026-11-02T14:34:04.00829Z"}],"euvd":[{"id":"EUVD-2024-0167","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.","status":"published","published":"2024-07-29T15:41:40Z","modified":"2025-11-03T22:01:01Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:29.890052Z"}],"ghsa":[{"id":"GHSA-cf56-g6w6-pqq2","title":"Twisted vulnerable to HTML injection in HTTP redirect body","description":"### Summary\n\nThe `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body.\n\n### Details\nTwisted’s `redirectTo` function generates an `HTTP 302 Redirect` response. The response contains an HTML body, built for exceptional cases where the browser doesn’t properly handle the redirect, allowing the user to click a link, navigating them to the specified destination.\n\nThe function reflects the destination URL in the HTML body without any output encoding. \n```python\n# https://github.com/twisted/twisted/blob/trunk/src/twisted/web/_template_util.py#L88\ndef redirectTo(URL: bytes, request: IRequest) -\u003e bytes:\n    # ---snip---\n    content = b\"\"\"\n\u003chtml\u003e\n    \u003chead\u003e\n        \u003cmeta http-equiv=\\\"refresh\\\" content=\\\"0;URL=%(url)s\\\"\u003e\n    \u003c/head\u003e\n    \u003cbody bgcolor=\\\"#FFFFFF\\\" text=\\\"#000000\\\"\u003e\n    \u003ca href=\\\"%(url)s\\\"\u003eclick here\u003c/a\u003e\n    \u003c/body\u003e\n\u003c/html\u003e\n\"\"\" % {\n        b\"url\": URL\n    }\n    return content\n```\n\nIf an attacker has full or partial control over redirect location due to an application bug, also known as an “Open Redirect”, they may inject arbitrary HTML into the response’s body, ultimately leading to an XSS attack.\n\nIt’s worth noting that the issue is known to maintainers and tracked with GitHub [Issue#9839](https://github.com/twisted/twisted/issues/9839). The issue description, however, does not make any mention of exploitability and simply states: “…Browsers don't seem to actually render that page…”\n\n### PoC\nThe issue can be reproduced by running the following Twisted-based HTTP server locally:\n```python\nfrom twisted.web import server, resource\nfrom twisted.internet import reactor\nfrom twisted.web.util import redirectTo\n\nclass Simple(resource.Resource):\n    isLeaf = True\n    def render_GET(self, request):\n        url = request.args[b'url'][0]  # \u003c-- open redirect\n        return redirectTo(url, request)\n\nsite = server.Site(Simple())\nreactor.listenTCP(9009, site)\nreactor.run()\n```\nOnce running, navigate to the following URL: `http://127.0.0.1:9009?url=ws://example.com/\"\u003e\u003cscript\u003ealert(document.location)\u003c/script\u003e`, and verify that the “alert” dialog was displayed.\n\n**Note**: Due to the different ways browsers validate the redirect Location header, this attack is possible only in **Firefox**. All other tested browsers will display an error message to the user and will not render the HTML body.\n\n### Impact\nIf successfully exploited, the issue will allow malicious JavaScript to run in the context of the victim's session. This will in turn lead to unauthorized access/modification to victim's account and information associated with it, or allow for unauthorized operations to be performed within the context of the victim's session.","status":"published","published":"2024-07-29T17:29:36Z","modified":"2025-11-04T16:51:20Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:06.376137Z"}],"nvd":[{"id":"CVE-2024-41810","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.","status":"published","published":"2024-07-29T16:15:05.133Z","modified":"2026-06-17T07:48:16.593Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79","CWE-80"],"updated_at":"2026-11-02T14:10:14.437386Z"}],"osv":[{"id":"AZL-47073","title":"CVE-2024-41810 affecting package python-twisted for versions less than 22.10.0-3","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.","status":"published","published":"2024-07-29T16:15:05Z","modified":"2026-04-21T04:32:48.812678Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"AZL-47195","title":"CVE-2024-41810 affecting package python-twisted for versions less than 22.10.0-3","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.","status":"published","published":"2024-07-29T16:15:05Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"CVE-2024-41810","title":"HTML injection in HTTP redirect body","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.","status":"published","published":"2024-07-29T15:41:40.289Z","modified":"2026-10-28T02:30:37.774887634Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79","CWE-80"],"updated_at":"2026-11-02T15:44:41.963899Z"},{"id":"DEBIAN-CVE-2024-41810","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.","status":"published","published":"2024-07-29T16:15:05.133Z","modified":"2026-11-02T12:02:58.882342934Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:43.156294Z"},{"id":"GHSA-cf56-g6w6-pqq2","title":"Twisted vulnerable to HTML injection in HTTP redirect body","description":"### Summary\n\nThe `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body.\n\n### Details\nTwisted’s `redirectTo` function generates an `HTTP 302 Redirect` response. The response contains an HTML body, built for exceptional cases where the browser doesn’t properly handle the redirect, allowing the user to click a link, navigating them to the specified destination.\n\nThe function reflects the destination URL in the HTML body without any output encoding. \n```python\n# https://github.com/twisted/twisted/blob/trunk/src/twisted/web/_template_util.py#L88\ndef redirectTo(URL: bytes, request: IRequest) -\u003e bytes:\n    # ---snip---\n    content = b\"\"\"\n\u003chtml\u003e\n    \u003chead\u003e\n        \u003cmeta http-equiv=\\\"refresh\\\" content=\\\"0;URL=%(url)s\\\"\u003e\n    \u003c/head\u003e\n    \u003cbody bgcolor=\\\"#FFFFFF\\\" text=\\\"#000000\\\"\u003e\n    \u003ca href=\\\"%(url)s\\\"\u003eclick here\u003c/a\u003e\n    \u003c/body\u003e\n\u003c/html\u003e\n\"\"\" % {\n        b\"url\": URL\n    }\n    return content\n```\n\nIf an attacker has full or partial control over redirect location due to an application bug, also known as an “Open Redirect”, they may inject arbitrary HTML into the response’s body, ultimately leading to an XSS attack.\n\nIt’s worth noting that the issue is known to maintainers and tracked with GitHub [Issue#9839](https://github.com/twisted/twisted/issues/9839). The issue description, however, does not make any mention of exploitability and simply states: “…Browsers don't seem to actually render that page…”\n\n### PoC\nThe issue can be reproduced by running the following Twisted-based HTTP server locally:\n```python\nfrom twisted.web import server, resource\nfrom twisted.internet import reactor\nfrom twisted.web.util import redirectTo\n\nclass Simple(resource.Resource):\n    isLeaf = True\n    def render_GET(self, request):\n        url = request.args[b'url'][0]  # \u003c-- open redirect\n        return redirectTo(url, request)\n\nsite = server.Site(Simple())\nreactor.listenTCP(9009, site)\nreactor.run()\n```\nOnce running, navigate to the following URL: `http://127.0.0.1:9009?url=ws://example.com/\"\u003e\u003cscript\u003ealert(document.location)\u003c/script\u003e`, and verify that the “alert” dialog was displayed.\n\n**Note**: Due to the different ways browsers validate the redirect Location header, this attack is possible only in **Firefox**. All other tested browsers will display an error message to the user and will not render the HTML body.\n\n### Impact\nIf successfully exploited, the issue will allow malicious JavaScript to run in the context of the victim's session. This will in turn lead to unauthorized access/modification to victim's account and information associated with it, or allow for unauthorized operations to be performed within the context of the victim's session.","status":"published","published":"2024-07-29T17:29:36Z","modified":"2025-11-04T17:06:06.972633Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"OESA-2024-1983","title":"python-twisted security update","description":"Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following:\r\n\r\nSecurity Fix(es):\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.(CVE-2024-41671)\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.(CVE-2024-41810)","status":"published","published":"2024-08-16T11:07:27Z","modified":"2026-08-18T01:18:33.2180122Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-1984","title":"python-twisted security update","description":"Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following:\r\n\r\nSecurity Fix(es):\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.(CVE-2024-41671)\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.(CVE-2024-41810)","status":"published","published":"2024-08-16T11:07:27Z","modified":"2026-08-18T01:18:33.302853463Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-1985","title":"python-twisted security update","description":"Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following:\r\n\r\nSecurity Fix(es):\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.(CVE-2024-41671)\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.(CVE-2024-41810)","status":"published","published":"2024-08-16T11:07:27Z","modified":"2026-08-18T01:18:33.466733864Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-1986","title":"python-twisted security update","description":"Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following:\r\n\r\nSecurity Fix(es):\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.(CVE-2024-41671)\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.(CVE-2024-41810)","status":"published","published":"2024-08-16T11:07:27Z","modified":"2026-08-18T01:18:33.420467374Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2052","title":"python-twisted security update","description":"Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following:\r\n\r\nSecurity Fix(es):\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.(CVE-2024-41671)\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.(CVE-2024-41810)","status":"published","published":"2024-08-23T11:07:31Z","modified":"2026-08-18T01:18:35.774294923Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"PYSEC-2024-75","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.","status":"published","published":"2024-07-29T16:15:00Z","modified":"2024-09-11T19:42:11.394508Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:54.242332Z"},{"id":"RHSA-2024:7312","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update","status":"published","published":"2024-10-01T18:22:49Z","modified":"2026-10-14T10:05:13Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"UBUNTU-CVE-2024-41810","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.","status":"published","published":"2024-07-29T16:15:00Z","modified":"2026-02-04T02:23:29.301674Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:58.679387Z"},{"id":"CLSA-2025-1762474360","title":"TuxCare security update for twisted (4 CVEs)","description":"TuxCare rebuilt twisted to address 4 CVEs. Fixed in 20.3.0.post4+tuxcare.","status":"published","published":"2026-08-04T14:52:09Z","modified":"2026-10-15T09:48:00.955124071Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"DLA-3970-1","title":"twisted - security update","status":"published","published":"2024-11-28T00:00:00Z","modified":"2026-03-09T01:22:40.257832Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5797-1","title":"twisted - security update","status":"published","published":"2024-10-25T00:00:00Z","modified":"2026-03-09T02:08:52.022156Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2025-0054","title":"Updated python-twisted packages fix security vulnerabilities","description":"Twisted.web has disordered HTTP pipeline response. (CVE-2023-46137)\nTwisted.web has disordered HTTP pipeline response. (CVE-2024-41671)\nHTML injection in HTTP redirect body. (CVE-2024-41810)\n","status":"published","published":"2025-02-12T06:37:33Z","modified":"2026-04-16T04:43:07.105273148Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2024:14236-1","title":"python-Twisted-doc-24.3.0-2.1 on GA media","description":"These are all security issues fixed in the python-Twisted-doc-24.3.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-08-01T00:00:00Z","modified":"2026-02-04T04:26:14.901205Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2024:2732-1","title":"Security update for python-Twisted","description":"This update for python-Twisted fixes the following issues:\n\n  - CVE-2024-41671: Fixed an information disclosure due to HTTP requests processed out-of-order (bsc#1228549)\n  - CVE-2024-41810: Fixed reflected XSS via HTML injection in redirect response (bsc#1228552)\n","status":"published","published":"2024-08-05T10:56:13Z","modified":"2026-02-04T02:44:49.19117Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2757-1","title":"Security update for python-Twisted","description":"This update for python-Twisted fixes the following issues:\n\n  - CVE-2024-41671: Fixed an information disclosure due to HTTP requests processed out-of-order (bsc#1228549)\n  - CVE-2024-41810: Fixed reflected XSS via HTML injection in redirect response (bsc#1228552)\n","status":"published","published":"2024-08-05T19:58:56Z","modified":"2026-02-04T02:40:39.361811Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2860-1","title":"Security update for python3-Twisted","description":"This update for python3-Twisted fixes the following issues:\n\n- CVE-2024-41671: Fixed HTTP pipelined requests processed out of order in twisted.web (bsc#1228549)\n- CVE-2024-41810: Fixed reflected XSS via HTML Injection in Redirect Response (bsc#1228552)\n","status":"published","published":"2024-08-09T05:34:13Z","modified":"2025-05-02T04:36:59.669633Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2880-1","title":"Security update for python-Twisted","description":"This update for python-Twisted fixes the following issues:\n\n  - CVE-2024-41671: Fixed an information disclosure due to HTTP requests processed out-of-order (bsc#1228549)\n  - CVE-2024-41810: Fixed reflected XSS via HTML injection in redirect response (bsc#1228552)\n","status":"published","published":"2024-08-12T15:39:09Z","modified":"2026-02-04T03:34:09.297504Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"USN-6988-1","title":"twisted vulnerabilities","description":"Ben Kallus discovered that Twisted incorrectly handled response order when\nprocessing multiple HTTP requests. A remote attacker could possibly use\nthis issue to delay and manipulate responses. \nThis issue only affected Ubuntu 24.04 LTS. (CVE-2024-41671)\n\nIt was discovered that Twisted did not properly sanitize certain input.\nAn attacker could use this vulnerability to possibly execute an HTML \ninjection leading to a cross-site scripting (XSS) attack. \n(CVE-2024-41810)\n","status":"published","published":"2024-09-04T08:40:06Z","modified":"2026-06-29T13:51:15.77401716Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}