CVE-2018-20677

MEDIUM6.1EPSS 9.8%

bootstrap Cross-site Scripting vulnerability

Published: 1/17/2019Modified: 4/28/2026

Description

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.

Affected packages (8)

Debian/twitter-bootstrap3from 0, < 3.4.0+dfsg-1
Maven/org.webjars:bootstrapfrom 0, < 3.4.0
npm/bootstrapfrom 0, < 3.4.0
npm/bootstrap-sassfrom 0, < 3.4.0
NuGet/bootstrapfrom 0, < 3.4.0
Packagist/twbs/bootstrapfrom 0, < 3.4.0
RubyGems/bootstrapfrom 0, < 3.4.0
RubyGems/bootstrap-sassfrom 0, < 3.4.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.1	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References (19)