CVE-2020-35774: 
Java vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was discovered in Twitter TwitterServer (CVE-2020-35774) before version 20.12.0. The vulnerability exists in the server/handler/HistogramQueryHandler.scala component, where in certain configurations, it allows XSS attacks via the /histograms endpoint (NVD, CVE).

The vulnerability stems from improper neutralization of user input in the HistogramQueryHandler component. When displaying error messages about invalid histogram queries, the application directly incorporated user-supplied query parameters into the output without proper HTML escaping. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.4 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

The vulnerability allows attackers to inject malicious scripts through the /histograms endpoint. When successful, this could lead to execution of arbitrary web scripts in the context of other users' browsers who access the affected endpoint (NVD).

The vulnerability requires an attacker to have low privileges and user interaction for successful exploitation. The attack complexity is low, but it requires the victim to interact with a malicious payload (NVD).

The vulnerability was fixed in TwitterServer version 20.12.0 by implementing proper HTML escaping of user-provided strings in the returned text. The fix specifically modifies the HistogramQueryHandler to escape user input using the escapeHtml function (GitHub Commit).