CVE-2020-35774

Опубликовано: 29 дек. 2020

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Высокий

Описание

server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint.

Ссылки

https://advisory.checkmarx.net/advisory/CX-2020-4287
Third Party Advisory
https://github.com/twitter/twitter-server/commit/e0aeb87e89a6e6c711214ee2de0dd9f6e5f9cb6c
Patch
Third Party Advisory
https://github.com/twitter/twitter-server/compare/twitter-server-20.10.0...twitter-server-20.12.0
Patch
Third Party Advisory
https://advisory.checkmarx.net/advisory/CX-2020-4287
Third Party Advisory
https://github.com/twitter/twitter-server/commit/e0aeb87e89a6e6c711214ee2de0dd9f6e5f9cb6c
Patch
Third Party Advisory
https://github.com/twitter/twitter-server/compare/twitter-server-20.10.0...twitter-server-20.12.0
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:twitter:twitter-server:*:*:*:*:*:*:*:*

Версия до 20.12.0 (исключая)

EPSS

Процентиль: 99%

0.81158

Высокий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-3mqv-8gxg-pfm4

CVSS3: 6.1

github

почти 4 года назад

TwitterServer Cross-site Scripting via /histograms endpoint