What’s Vulnerable › Vulnerabilities

CVE-2020-35774

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 85.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-12-29 · updated 2026-06-17
• Weakness: CWE-79

Description

server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint.

Affected products

• Twitter-Server: before 20.12.0 — fixed in 20.12.0

How to fix

Upgrade to a fixed version: Twitter-Server 20.12.0. Check the vendor advisory for mitigations.

References

• https://advisory.checkmarx.net/advisory/CX-2020-4287
• https://github.com/twitter/twitter-server/commit/e0aeb87e89a6e6c711214ee2de0dd9f6e5f9cb6c
• https://github.com/twitter/twitter-server/compare/twitter-server-20.10.0...twitter-server-20.12.0
• https://advisory.checkmarx.net/advisory/CX-2020-4287
• https://github.com/twitter/twitter-server/commit/e0aeb87e89a6e6c711214ee2de0dd9f6e5f9cb6c
• https://github.com/twitter/twitter-server/compare/twitter-server-20.10.0...twitter-server-20.12.0

Get alerted when CVE-2020-35774 or the next vulnerability affects your stack