TwitterServer Cross-site Scripting via /histograms endpoint

MEDIUM 5.4CVE-2020-35774 · GHSA-3mqv-8gxg-pfm4 · Published 29/12/2020 · updated 17/06/2026

Package	Affected versions	Patched versions
com.twitter:twitter-server_2.12 Maven	`< 20.12.0`	`20.12.0`
twitter-server twitter	`< 20.12.0`	`20.12.0`

Description

server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint.

NVD description

server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint.

References

nvd.nist.gov/vuln/detail/CVE-2020-35774 · ADVISORY
twitter/twitter-server commit e0aeb87 · WEB
advisory.checkmarx.net/advisory/CX-2020-4287 · WEB
twitter/twitter-server · PACKAGE
twitter/twitter-server · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free