OpenCTI GitHub Repositoryproduct
https://github.com/OpenCTI-Platform/opencti CVE-2020-37044
MEDIUM
OpenCTI 3.3.1 - Cross Site Scripting
Record summary
CVE-2020-37044 has a selected CVSS score of 5.1 (medium); EIP currently links 1 catalogued exploit.
Description
OpenCTI 3.3.1 is vulnerable to a reflected cross-site scripting (XSS) attack via the /graphql endpoint. An attacker can inject arbitrary JavaScript code by sending a crafted GET request with a malicious payload in the query string, leading to execution of JavaScript in the victim's browser. For example, a request to /graphql?'"--></style></scRipt><scRipt>alert('Raif_Berkay')</scRipt> will trigger an alert. This vulnerability was discovered by Raif Berkay Dincel and confirmed on Linux Mint and Windows 10.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 2, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
OpenCTIBrowse Filigran / OpenCTI | CVE List | 3.3.1 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBOpenCTI 3.3.1 - Directory TraversalExploitDB exploitby Raif Berkay DincelNot analyzed1 file
References
5nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2020-37044 ExploitDB-48595exploit
https://www.exploit-db.com/exploits/48595 OpenCTI Official Homepageproduct
https://www.opencti.io/ VulnCheck Advisory: OpenCTI 3.3.1 - Cross Site ScriptingThird-party advisory
https://www.vulncheck.com/advisories/opencti-cross-site-scripting