CVE-2020-35774 (Medium) detected in twitter-server_2.11-19.12.0.jar, twitter-server_2.11-1.28.0.jar - autoclosed

[mend-for-github-com]

CVE-2020-35774 - Medium Severity Vulnerability

Vulnerable Libraries - twitter-server_2.11-19.12.0.jar, twitter-server_2.11-1.28.0.jar

twitter-server_2.11-19.12.0.jar

twitter-server

Library home page: https://github.com/twitter/twitter-server

Path to dependency file: /dd-java-agent/instrumentation/finatra-2.9/finatra-2.9.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.twitter/twitter-server_2.11/19.12.0/4bc821db059c0c26872abe75b28cd7254ffdf04a/twitter-server_2.11-19.12.0.jar

Dependency Hierarchy:

• finatra-http_2.11-19.12.0.jar (Root Library)
  • inject-server_2.11-19.12.0.jar
    • ❌ twitter-server_2.11-19.12.0.jar (Vulnerable Library)

twitter-server_2.11-1.28.0.jar

twitter-server

Library home page: https://github.com/twitter/twitter-server

Path to dependency file: /dd-java-agent/instrumentation/finatra-2.9/finatra-2.9.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.twitter/twitter-server_2.11/1.28.0/d6eb1023ea3a0d56c48af3963ebbb8443ba8c283/twitter-server_2.11-1.28.0.jar

Dependency Hierarchy:

• finatra-http_2.11-2.9.0.jar (Root Library)
  • inject-server_2.11-2.9.0.jar
    • ❌ twitter-server_2.11-1.28.0.jar (Vulnerable Library)

Found in HEAD commit: 2819174635979a19573ec0ce8e3e2b63a3848079

Found in base branch: master

Vulnerability Details

server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint.

Publish Date: 2020-12-29

URL: CVE-2020-35774

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-12-29

Fix Resolution (com.twitter:twitter-server_2.11): 20.12.0

Direct dependency fix Resolution (com.twitter:finatra-http_2.11): 20.12.0

Fix Resolution (com.twitter:twitter-server_2.11): 20.12.0

Direct dependency fix Resolution (com.twitter:finatra-http_2.11): 20.12.0

---

⛑️ Automatic Remediation is available for this issue