CVE-2018-20677 (MEDIUM 6.1) · Watchpost

← All vulnerabilities

bootstrap Cross-site Scripting vulnerability

MEDIUM 6.1CVE-2018-20677 · GHSA-ph58-4vrj-w6hr · Published 09/01/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
org.webjars:bootstrap Maven	`< 3.4.0`	`3.4.0`
bootstrap NuGet	`< 3.4.0`	`3.4.0`
twbs/bootstrap Packagist	`< 3.4.0`	`3.4.0`
bootstrap RubyGems	`< 3.4.0`	`3.4.0`
bootstrap-sass RubyGems	`< 3.4.0`	`3.4.0`
bootstrap getbootstrap	`< 3.4.0`	`3.4.0`
bootstrap npm	`< 3.4.0`	`3.4.0`
bootstrap-sass npm	`< 3.4.0`	`3.4.0`

Description

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.

NVD description

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.

References

nvd.nist.gov/vuln/detail/CVE-2018-20677 · ADVISORY
twbs/bootstrap · WEB
twbs/bootstrap · WEB
twbs/bootstrap · WEB
twbs/bootstrap#27047 · WEB
twbs/bootstrap commit 2a5ba23 · WEB
lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E · WEB
lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e@%3Cdev.superset.apache.org%3E · WEB
twbs/bootstrap · PACKAGE
rubysec/ruby-advisory-db · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free