---
title: "CX-2020-4287"
date: "2021-01-06T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cx-2020-4287/"
---

# CX-2020-4287

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

Fixed: Dec 11, 2020

CVE-2020-35774  **Published:** Jan 6, 2021

6.1 Medium Severity JAVA twitter XSS

DT Dor Tumarkin  Reported by Checkmarx Zero

Details Overview

## Summary

A Reflected Cross Site Scripting (XSS) was found in twitter-server. The vulnerability exists in the administration panel of twitter-server in the `histograms` component.

## Product

Twitter-server before 20.12.0

## Impact

This can cause arbitrary JavaScript code to run on the victim’s browser and allowed attackers to retrieve information presented in the twitter-server admin dashboard web-application.

## Steps to reproduce

```
1. Create basic twitter-server instance.
2. Add “finagle-stats” dependency to project to enable histograms tab.
    >>> Can be added explicitly – e.g. in build.sbt – libraryDependencies += “com.twitter” %% “finagle-stats” % “20.10.0”.
    >>> Implicitly as part of the finatra-http dependency – e.g. in build.sbt – libraryDependencies += “com.twitter” %% “finatra-http” % “20.10.0
3. Run project.
4. Browse to: http://twitter-server-host/admin/histograms?h=%3Cscript%3Ealert(1)%3C/script%3E&fmt=plot_cdf&log_scale=true
```

### Expected result:

An alert box should be displayed with the text “1”.

## Remediation

Update twitter-server dependency to 20.12.0 and above

## Credit

This issue was discovered and reported by Checkmarx Security Researcher Dor Tumarkin.

## Resources

1. [e0aeb87](https://github.com/twitter/twitter-server/commit/e0aeb87e89a6e6c711214ee2de0dd9f6e5f9cb6c)

0  Medium Severity CVSS v3.1 Score

   6.1

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

Advisory Timeline1. Disclosed Oct 29, 2020 Disclosure via HackerOne
2. Oct 30, 2020 Issue — Issue acknowledged by Twitter
3. Fixed Dec 11, 2020 Fixed version 20.12.0

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)