CVE-2018-20677 — Vulnerability in bootstrap — CVE Details

MEDIUM

bootstrap Cross-site Scripting vulnerability

Published January 17, 2019Updated September 10, 2026Source: osv

Summary

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.

Advisory Timeline

First published January 17, 2019 (2825 days ago).
Last revised September 10, 2026 — 2793 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Bundler

Update bootstrap to 3.4.0 or later

gem install bootstrap -v 3.4.0

Maven

Update org.webjars:bootstrap to 3.4.0 or later

<!-- Update pom.xml dependency version to 3.4.0 for org.webjars:bootstrap -->

npm

Update bootstrap-sass to 3.4.0 or later

npm install bootstrap-sass@3.4.0

Composer

Update twbs/bootstrap to 3.4.0 or later

composer require "twbs/bootstrap:^3.4.0"

npm

Update bootstrap to 3.4.0 or later

npm install bootstrap@3.4.0

NuGet

Update bootstrap to 3.4.0 or later

dotnet add package bootstrap --version 3.4.0

Bundler

Update bootstrap-sass to 3.4.0 or later

gem install bootstrap-sass -v 3.4.0

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (7)

Affects 5 ecosystems: npm (2), rubygems (2), maven (1), nuget (1), packagist (1).

Package	Ecosystem	Affected	Fixed In
bootstrap	rubygems	All versions	3.4.0
org.webjars:bootstrap	maven	1.3.0, 2.0.2, 2.1.1, 2.2.1 (+29 more)	3.4.0
bootstrap-sass	npm	All versions	3.4.0
twbs/bootstrap	packagist	v2.2.2, v2.3.0, v2.3.1, v2.3.2 (+16 more)	3.4.0
bootstrap	npm	All versions	3.4.0
bootstrap	nuget	1.0.0, 2.3.1, 2.3.2, 3.0.0 (+15 more)	3.4.0
bootstrap-sass	rubygems	1.2.0, 1.2.1, 1.3.0, 1.3.1 (+53 more)	3.4.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-79
Cross-site Scripting (XSS)MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 6.1 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

Frequently Asked Questions

What is CVE-2018-20677?: bootstrap Cross-site Scripting vulnerability This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 6.1/10).
How do I check if my project is affected by CVE-2018-20677?: CVE-2018-20677 affects bootstrap, org.webjars:bootstrap and bootstrap-sass (and 1 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2018-20677 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

6.1

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-ph58-4vrj-w6hr

Related CVEs

CVE-2018-20676
MEDIUM
XSS vulnerability that affects bootstrap
CVE-2018-14040
MEDIUM
Bootstrap vulnerable to Cross-Site Scripting (XSS)
CVE-2016-10735
MEDIUM
Bootstrap Cross-site Scripting vulnerability
CVE-2019-11358
MEDIUM
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
CVE-2018-14042
MEDIUM
Bootstrap Cross-site Scripting vulnerability
CVE-2021-41182
MEDIUM
XSS in the `altField` option of the Datepicker widget in jquery-ui
CVE-2019-8331
MEDIUM
Bootstrap Vulnerable to Cross-Site Scripting
CVE-2018-14041
MEDIUM
Bootstrap Cross-site Scripting vulnerability

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies