GitHub Advisoryadvisory · npm, Packagist, Maven, RubyGems, NuGet

GHSA-ph58-4vrj-w6hr bootstrap Cross-site Scripting vulnerability

MEDIUM Published 2019-01-17 Modified 2024-08-05 Official page ↗
Aliases
CVE-2018-20677
Ecosystem
npm, Packagist, Maven, RubyGems, NuGet
Packages
bootstrap, bootstrap-sass, twbs/bootstrap, org.webjars:bootstrap
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• npm bootstrap: < 3.4.0 → fixed in 3.4.0 • npm bootstrap-sass: < 3.4.0 → fixed in 3.4.0 • Packagist twbs/bootstrap: < 3.4.0 → fixed in 3.4.0 • Maven org.webjars:bootstrap: < 3.4.0 → fixed in 3.4.0 • RubyGems bootstrap: < 3.4.0 → fixed in 3.4.0 • RubyGems bootstrap-sass: < 3.4.0 → fixed in 3.4.0 • NuGet bootstrap: < 3.4.0 → fixed in 3.4.0

Description

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.

Related

Alias · CVE (1)

  • CVE-2018-20677 In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References