PT-2020-17417 · Twitter · Twitterserver

Mosesn · Published 2020-12-29 · Updated 2022-07-19 · CVE-2020-35774

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Twitter TwitterServer (aka twitter-server) versions prior to 20.12.0

Description The issue allows XSS via the "/histograms" endpoint in certain configurations.

Recommendations For versions prior to 20.12.0, update to version 20.12.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/histograms" endpoint until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-35774

GHSA-3MQV-8GXG-PFM4

Affected Products

Twitterserver

References · 9

• https://github.com/twitter/twitter-server/commit/e0aeb87e89a6e6c711214ee2de0dd9f6e5f9cb6c · Patch
• https://github.com/twitter/twitter-server/compare/twitter-server-20.10.0...twitter-server-20.12.0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-35774 · Security Note
• https://osv.dev/vulnerability/GHSA-3mqv-8gxg-pfm4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-35774 · Vendor Advisory
• https://github.com/twitter/twitter-server · Note
• https://t.me/cybersecuritytechnologies/2466 · Telegram Post
• https://advisory.checkmarx.net/advisory/CX-2020-4287 · Note
• https://t.me/cvenotify/7922 · Telegram Post