Vulnerability Details : CVE-2023-29218
The Twitter Recommendation Algorithm through ec83d01 allows attackers to cause a denial of service (reduction of reputation score) by arranging for multiple Twitter accounts to coordinate negative signals regarding a target account, such as unfollowing, muting, blocking, and reporting, as exploited in the wild in March and April 2023. NOTE: Vendor states that allowing users to unfollow, mute, block, and report tweets and accounts and the impact of these negative engagements on Twitter’s ranking algorithm is a conscious design decision, rather than a security vulnerability.
Vulnerability category: Denial of service
Products affected by CVE-2023-29218
- cpe:2.3:a:twitter:recommendation_algorithm:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-29218
0.16%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 54 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-29218
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
References for CVE-2023-29218
-
https://steventey.com/blog/twitter-algorithm
How the Twitter Algorithm works in 2023Product
-
https://twitter.com/Kaptain_Kobold/status/1642379706925477888
Kaptain Kobold @kaptainkobold@theblower.au on Twitter: "@steventey So reporting a tweet and then blocking the user really screws up their ability to be seen? A useful thing to know." / TwitterThird Party Advisory
-
https://twitter.com/elonmusk/status/1642324821324230657
Elon Musk on Twitter: "@boriquagato Who is behind these botnets? Million dollar bounty if convicted." / TwitterThird Party Advisory
-
https://twitter.com/aakashg0/status/1641976913165180929
Aakash Gupta 🚀 Product Growth Guy on Twitter: "4. Mutes & unfollows hurt All of the following hurt your engagement: • Mutes • Blocks • Unfollows • Spam reports • Abuse reports https://t.co/Viq19WThird Party Advisory
-
https://github.com/twitter/the-algorithm/tree/ec83d01dcaebf369444d75ed04b3625a0a645eb9
GitHub - twitter/the-algorithm at ec83d01dcaebf369444d75ed04b3625a0a645eb9Product
-
https://github.com/twitter/the-algorithm/issues/1386
Recommendation Algorithm Manipulation via mass blocks · Issue #1386 · twitter/the-algorithm · GitHubIssue Tracking;Third Party Advisory
Jump to