GHSA-3mqv-8gxg-pfm4

TwitterServer Cross-site Scripting via /histograms endpoint

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-35774

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.twitter:twitter-server_2.12	< 20.12.0	20.12.0

Details

As written in the advisory (Markdown source, shown as plain text).

server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-35774 advisory
https://github.com/twitter/twitter-server/commit/e0aeb87e89a6e6c711214ee2de0dd9f6e5f9cb6c web
https://advisory.checkmarx.net/advisory/CX-2020-4287 web
https://github.com/twitter/twitter-server package
https://github.com/twitter/twitter-server/compare/twitter-server-20.10.0...twitter-server-20.12.0 web