PT-2019-5359 · Twitter+4 · Bootstrap+4

Yanshuchong · Published 2019-01-09 · Updated 2025-09-29 · CVE-2018-20677

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Bootstrap versions prior to 3.4.0

Description The issue is related to the affix plugin in Bootstrap, which does not properly protect the structure of a web page, allowing for potential exploitation. This could enable a remote attacker to perform cross-site scripting attacks.

Recommendations For versions prior to 3.4.0, update to version 3.4.0 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALSA-2020:4670

ALSA-2025_16880

AZL-44799

BDU:2020-02566

CESA-2020_3936

CESA-2020_4670

CVE-2018-20677

GHSA-PH58-4VRJ-W6HR

RHSA-2019:3023

RHSA-2020:3936

RHSA-2020:4670

RHSA-2020:5571

RHSA-2020_3936

RHSA-2020_4670

RHSA-2023:5693

RLSA-2020:4670

Affected Products

Almalinux

Bootstrap

Centos

Red Hat

Rocky Linux

References · 108

• 🔥 https://github.com/twbs/bootstrap/issues/27045 · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap-sass/CVE-2018-20677.yml · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap/CVE-2018-20677.yml · Exploit
• https://github.com/twbs/bootstrap/pull/27047 · Patch
• https://ubuntu.com/security/CVE-2018-20677 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2020:0133 · Vendor Advisory
• https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20677 · Security Note
• https://access.redhat.com/errata/RHBA-2019:1076 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:3023 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2020:4670 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-20677 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:1456 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-20677 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-20677 · Vendor Advisory