PT-2019-5359 · Twitter+4 · Bootstrap+4

Yanshuchong · Publicado 2019-01-09 · Atualizado 2025-09-29 · CVE-2018-20677

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Bootstrap versions prior to 3.4.0

Description The issue is related to the affix plugin in Bootstrap, which does not properly protect the structure of a web page, allowing for potential exploitation. This could enable a remote attacker to perform cross-site scripting attacks.

Recommendations For versions prior to 3.4.0, update to version 3.4.0 or later to resolve the issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

ALSA-2020:4670

ALSA-2025_16880

AZL-44799

BDU:2020-02566

CESA-2020_3936

CESA-2020_4670

CVE-2018-20677

GHSA-PH58-4VRJ-W6HR

RHSA-2019:3023

RHSA-2020:3936

RHSA-2020:4670

RHSA-2020:5571

RHSA-2020_3936

RHSA-2020_4670

RHSA-2023:5693

RLSA-2020:4670

Produtos afetados

Almalinux

Bootstrap

Centos

Red Hat

Rocky Linux

Referências · 108

• 🔥 https://github.com/twbs/bootstrap/issues/27045 · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap-sass/CVE-2018-20677.yml · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap/CVE-2018-20677.yml · Exploit
• https://github.com/twbs/bootstrap/issues/27915#issuecomment-452196628 · Nota
• https://github.com/twbs/bootstrap/pull/27047 · Correção
• https://github.com/twbs/bootstrap/issues/27915#issuecomment-452140906 · Nota
• https://github.com/twbs/bootstrap · Nota
• https://github.com/twbs/bootstrap/commit/2a5ba23ce8f041f3548317acc992ed8a736b609d · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1810154 · Nota
• https://ubuntu.com/security/CVE-2018-20677 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1845211 · Nota
• https://access.redhat.com/security/cve/cve-2018-20677 · Nota
• https://access.redhat.com/errata/RHSA-2020:0133 · Aviso do Fabricante
• https://vulners.com/cve/CVE-2018-14040 · Nota
• https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0 · Aviso do Fabricante