CVE-2018-20676: XSS
A flaw was found in Bootstrap before 3.4.0. XSS is possible in the tooltip data-viewport attribute.
References: https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/ https://github.com/twbs/bootstrap/issues/27044 https://github.com/twbs/bootstrap/issues/27915#issuecomment-452140906 https://github.com/twbs/bootstrap/issues/27915#issuecomment-452196628
Upstream Patch: https://github.com/twbs/bootstrap/pull/27047
Other sources
A flaw was found in Bootstrap, where it is vulnerable to Cross-site scripting, caused by improper validation of user-supplied input by the tooltip data-viewport attribute. This flaw allows a remote attacker to execute a script in a victim's Web browser within the security context of the hosting Web site, which can lead to stealing the victim's cookie-based authentication credentials.
Bootstrap is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the tooltip data-viewport attribute. A remote attacker could exploit this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2018-20676?
CVE-2018-20676 is a vulnerability in Bootstrap before version 3.4.0 that allows for cross-site scripting (XSS) in the tooltip data-viewport attribute.
How severe is CVE-2018-20676?
CVE-2018-20676 has a severity score of 6.1, which is considered medium.
What software is affected by CVE-2018-20676?
Bootstrap versions before 3.4.0 are affected by CVE-2018-20676.
How can I fix CVE-2018-20676?
To fix CVE-2018-20676, you should update Bootstrap to version 3.4.0 or later.
Where can I find more information about CVE-2018-20676?
You can find more information about CVE-2018-20676 at the following references: [link 1](https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/), [link 2](https://github.com/twbs/bootstrap/issues/27044), [link 3](https://github.com/twbs/bootstrap/issues/27915#issuecomment-452140906).