CVE-2018-20677

MEDIUM

Bootstrap < 3.4.0 - XSS

Title source: rule

Description

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.

References (14)

Scores

CVSS v3 6.1
EPSS 0.1187
EPSS Percentile 93.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Classification

CWE
CWE-79
Status published

Affected Products (8)

getbootstrap/bootstrap < 3.4.0
npm/bootstrap < 3.4.0npm
npm/bootstrap-sass < 3.4.0npm
twbs/bootstrap < 3.4.0Packagist
org.webjars/bootstrap < 3.4.0Maven
rubygems/bootstrap < 3.4.0RubyGems
rubygems/bootstrap-sass < 3.4.0RubyGems
nuget/bootstrap < 3.4.0NuGet

Timeline

Published Jan 09, 2019
Tracked Since Feb 18, 2026