What is GHSA-3mqv-8gxg-pfm4?

GHSA-3mqv-8gxg-pfm4 is a security advisory published by GitHub Security Advisories with Medium severity. TwitterServer Cross-site Scripting via /histograms endpoint

Which CVE IDs does GHSA-3mqv-8gxg-pfm4 cover?

GHSA-3mqv-8gxg-pfm4 covers the following CVE IDs: CVE-2020-35774. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3mqv-8gxg-pfm4?

GHSA-3mqv-8gxg-pfm4 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-3mqv-8gxg-pfm4?

GHSA-3mqv-8gxg-pfm4 affects 1 product, including: maven/com.twitter:twitter-server_2.12:\u003c 20.12.0.

GHSA-3mqv-8gxg-pfm4MediumCVSS 6.1

TwitterServer Cross-site Scripting via /histograms endpoint

Vendor

GitHub Security Advisories

Published

February 9, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2020-35774 →

📋 Description

server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint.

🎯 Affected products1

maven/com.twitter:twitter-server_2.12:< 20.12.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2020-35774
https://github.com/twitter/twitter-server/commit/e0aeb87e89a6e6c711214ee2de0dd9f6e5f9cb6c
https://advisory.checkmarx.net/advisory/CX-2020-4287
https://github.com/twitter/twitter-server/compare/twitter-server-20.10.0...twitter-server-20.12.0
https://github.com/advisories/GHSA-3mqv-8gxg-pfm4