TwitterServer Cross-site Scripting via /histograms endpoint

MEDIO 5.4CVE-2020-35774 · GHSA-3mqv-8gxg-pfm4 · Published 29/12/2020 · updated 17/06/2026

En resumen

CVE-2020-35774 es una vulnerabilidad MEDIO (CVSS 5.4) que afecta a com.twitter:twitter-server_2.12, twitter-server (twitter).
Probabilidad de explotación en los próximos 30 días (EPSS): 85.6%, mayor que el 99.7% de las vulnerabilidades.
Solución: actualizar a 20.12.0 o posterior.

Package	Affected versions	Patched versions
com.twitter:twitter-server_2.12 Maven	`< 20.12.0`	`20.12.0`
twitter-server twitter	`< 20.12.0`	`20.12.0`

Description

server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint.

NVD description

server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint.

References

nvd.nist.gov/vuln/detail/CVE-2020-35774 · ADVISORY
twitter/twitter-server commit e0aeb87 · WEB
advisory.checkmarx.net/advisory/CX-2020-4287 · WEB
twitter/twitter-server · PACKAGE
twitter/twitter-server · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free