PT-2021-12007 · Unknown · Analytics-Quarry-Web

Published 2021-04-21 · Updated 2021-04-26 · CVE-2020-36324

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: analytics-quarry-web versions prior to 2020-12-15

Description: The issue allows for Reflected XSS because the application/json content type is not explicitly set in app.py.

Recommendations: For versions prior to 2020-12-15, update to a version that explicitly sets the application/json content type in app.py to prevent Reflected XSS.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-36324

Affected Products

Analytics-Quarry-Web

References · 4

• https://github.com/wikimedia/analytics-quarry-web/commit/4b7e1d6a3a52ec6cf826a971135a38b0f74785d2 · Patch
• https://osv.dev/vulnerability/CVE-2020-36324 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36324 · Security Note
• https://quarry.wmflabs.org · Note