server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NTwitter Server
APPTwitter< 20.12.0
π’
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
XSS
CWE
References
Related vulnerabilities
CVE-2023-29218HIGH7.5ten sam vendor
The Twitter Recommendation Algorithm through ec83d01 allows attackers to cause a denial of service (reduction ...
CVE-2019-16263HIGH7.4ten sam vendor
The Twitter Kit framework through 3.4.2 for iOS does not properly validate the api.twitter.com SSL certificate...
CVE-2020-5216MEDIUM4.4ten sam vendor
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before ...
CVE-2020-5217MEDIUM4.4ten sam vendor
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before ...
CVE-2019-5431MEDIUM5.4ten sam vendor
This vulnerability was caused by an incomplete fix to CVE-2017-0911. Twitter Kit for iOS versions 3.0 to 3.4.0...