CVE-2018-20676 (MEDIUM 6.1) · Watchpost

← All vulnerabilities

XSS vulnerability that affects bootstrap

MEDIUM 6.1CVE-2018-20676 · GHSA-3mgp-fx93-9xv5 · Published 09/01/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
org.webjars:bootstrap Maven	`< 3.4.0`	`3.4.0`
bootstrap NuGet	`< 3.4.0`	`3.4.0`
twbs/bootstrap Packagist	`< 3.4.0`	`3.4.0`
bootstrap RubyGems	`< 3.4.0`	`3.4.0`
bootstrap-sass RubyGems	`< 3.4.0`	`3.4.0`
bootstrap getbootstrap	`< 3.4.0`	`3.4.0`
bootstrap npm	`< 3.4.0`	`3.4.0`
bootstrap-sass npm	`< 3.4.0`	`3.4.0`

Description

In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.

NVD description

In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.

References

nvd.nist.gov/vuln/detail/CVE-2018-20676 · ADVISORY
twbs/bootstrap · WEB
twbs/bootstrap · WEB
twbs/bootstrap · WEB
twbs/bootstrap#27047 · WEB
twbs/bootstrap commit 2a5ba23 · WEB
lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E · WEB
twbs/bootstrap · PACKAGE
rubysec/ruby-advisory-db · WEB
rubysec/ruby-advisory-db · WEB
blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free