Skip to content
Fencer Vulns
medium 6.1

CVE-2018-20676 json

XSS vulnerability that affects bootstrap

published 2019-01-09 7 y ago modified 2026-09-10 1 mo ago also GHSA-3mgp-fx93-9xv5 , EUVD-2019-0170

cvss
6.1
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.8%
EPSS 3.8% chance of exploitation in 30 days, percentile 90%
public exploits
0
none known

Summary

In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.

Patch / fix

  • npm bootstrap 3.4.0
  • npm bootstrap-sass 3.4.0
  • packagist twbs/bootstrap 3.4.0
  • maven org.webjars:bootstrap 3.4.0
  • rubygems bootstrap 3.4.0
  • rubygems bootstrap-sass 3.4.0
  • nuget bootstrap 3.4.0
  • getbootstrap bootstrap 3.4.0
  • twitter-bootstrap3 Debian 14, Debian 13, Debian 12 3.4.0+dfsg-1

debian advisories DEBIAN-CVE-2018-20676

  • ipa RHEL 8 4.8.7-12.module+el8.3.0+8223+6212645f
  • pyusb RHEL 8 1.0.0-9.module+el8.1.0+4107+4a66eb87
  • softhsm RHEL 8 2.6.0-3.module+el8.3.0+6909+fb33717d
  • custodia RHEL 8 0.6.0-3.module+el8.1.0+4098+f286395e
  • slapi-nis RHEL 8 0.56.5-4.module+el8.3.0+8222+c1bff54a
  • ipa-client RHEL 8 4.8.7-12.module+el8.3.0+8223+6212645f
  • ipa-common RHEL 8 4.8.7-12.module+el8.3.0+8223+6212645f
  • ipa-server RHEL 8 4.8.7-12.module+el8.3.0+8222+c1bff54a

red hat advisories RHSA-2020:4670RHSA-2020:3936RHSA-2023:5693RHSA-2020:5571RHSA-2019:3023RHBA-2019:1570

  • custodia AlmaLinux 8 0.6.0-3.module_el8.6.0+2881+2f24dc92
  • python3-pyusb AlmaLinux 8 1.0.0-9.module_el8.5.0+2641+983b221b
  • python3-pyusb AlmaLinux 8 1.0.0-9.module_el8.6.0+2881+2f24dc92
  • python3-pyusb AlmaLinux 8 1.0.0-9.module_el8.6.0+2737+7e73ea90
  • python3-qrcode AlmaLinux 8 5.1-12.module_el8.6.0+2881+2f24dc92
  • python3-qrcode AlmaLinux 8 5.1-12.module_el8.5.0+2641+983b221b
  • python3-qrcode AlmaLinux 8 5.1-12.module_el8.6.0+2737+7e73ea90
  • python3-yubico AlmaLinux 8 1.3.2-9.module_el8.5.0+2641+983b221b

almalinux advisories ALSA-2020:4670

  • pyusb Rocky Linux 8 1.0.0-9.module+el8.4.0+429+6bd33fea
  • pyusb Rocky Linux 8 1.0.0-9.1.module+el8.7.0+1074+aae18f3a
  • custodia Rocky Linux 8 0.6.0-3.module+el8.4.0+429+6bd33fea
  • python-qrcode Rocky Linux 8 5.1-12.module+el8.4.0+429+6bd33fea
  • python-yubico Rocky Linux 8 1.3.2-9.module+el8.4.0+429+6bd33fea
  • python-yubico Rocky Linux 8 1.3.2-9.1.module+el8.7.0+1074+aae18f3a
  • python-jwcrypto Rocky Linux 8 0.5.0-1.module+el8.4.0+429+6bd33fea
  • python-jwcrypto Rocky Linux 8 0.5.0-1.1.module+el8.7.0+1074+aae18f3a

rocky linux advisories RLSA-2020:4670

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-20676 updated cvss 6.1

bootstrap: XSS in the tooltip data-viewport attribute

  • Red Hat Ceph Storage 4 ceph, librbd1, librgw2, rbd-nbd, ceph-mds, ceph-mgr, +27 more
    affected: no fix planned “Out of support scope”
  • Red Hat Ceph Storage 5 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mds, +33 more
    affected: no fix available
  • Red Hat Fuse 7 bootstrap Red Hat JBoss Data Grid 7 bootstrap Red Hat JBoss Enterprise Web Server 2 bootstrap Red Hat OpenShift Container Platform 3.11 openshift3/ose-console
    affected: no fix planned “Out of support scope”
  • Red Hat OpenStack Platform 8 (Liberty) python-XStatic-Bootstrap-SCSS Red Hat OpenStack Platform 9 (Mitaka) python-XStatic-Bootstrap-SCSS Red Hat OpenStack Platform 10 (Newton) python-XStatic-Bootstrap-SCSS
    affected: no fix planned “Will not fix”
  • Red Hat OpenStack Platform 14 (Rocky) python-XStatic-Bootstrap-SCSS, xstatic-bootstrap-scss-common
    affected: no fix available
  • Red Hat OpenStack Platform 15 (Stein) xstatic-bootstrap-scss-common, python3-XStatic-Bootstrap-SCSS
    affected: no fix planned “Will not fix”
  • Red Hat Virtualization 4 ovirt-js-dependencies, ovirt-engine-dashboard
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 cockpit, cockpit-ws, 389-ds-base, cockpit-pcp, cockpit-389-ds, cockpit-bridge, +11 more Red Hat Enterprise Linux 9 cockpit-composer Red Hat Satellite 6 nodejs-patternfly-react-catalog-view-extension
    under investigation
show 8 more
  • Red Hat Decision Manager 7
    fixed: vendor fix RHSA-2020:0133
  • Red Hat Enterprise Linux AppStream (v. 8) ipa 4.8.7-12.module+el8.3.0+8222+c1bff54a, ipa 4.8.7-12.module+el8.3.0+8223+6212645f, pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, pyusb 1.0.0-9.module+el8.1.0+4107+4a66eb87, softhsm 2.6.0-3.module+el8.3.0+6909+fb33717d, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, +49 more
    fixed: vendor fix RHSA-2020:4670
  • Red Hat Enterprise Linux Client (v. 7) ipa 4.6.8-5.el7, ipa-client 4.6.8-5.el7, ipa-common 4.6.8-5.el7, python2-ipalib 4.6.8-5.el7, ipa-client-common 4.6.8-5.el7, ipa-python-compat 4.6.8-5.el7, +1 more Red Hat Enterprise Linux Client Optional (v. 7) ipa-server 4.6.8-5.el7, ipa-server-dns 4.6.8-5.el7, ipa-server-common 4.6.8-5.el7, python2-ipaserver 4.6.8-5.el7, ipa-server-trust-ad 4.6.8-5.el7 Red Hat Enterprise Linux ComputeNode (v. 7) ipa 4.6.8-5.el7, ipa-client 4.6.8-5.el7, ipa-common 4.6.8-5.el7, python2-ipalib 4.6.8-5.el7, ipa-client-common 4.6.8-5.el7, ipa-python-compat 4.6.8-5.el7, +1 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) ipa-server 4.6.8-5.el7, ipa-server-dns 4.6.8-5.el7, ipa-server-common 4.6.8-5.el7, python2-ipaserver 4.6.8-5.el7, ipa-server-trust-ad 4.6.8-5.el7 Red Hat Enterprise Linux Server (v. 7) ipa 4.6.8-5.el7, ipa-client 4.6.8-5.el7, ipa-common 4.6.8-5.el7, ipa-server 4.6.8-5.el7, ipa-server-dns 4.6.8-5.el7, python2-ipalib 4.6.8-5.el7, +6 more Red Hat Enterprise Linux Workstation (v. 7) ipa 4.6.8-5.el7, ipa-client 4.6.8-5.el7, ipa-common 4.6.8-5.el7, ipa-server 4.6.8-5.el7, ipa-server-dns 4.6.8-5.el7, python2-ipalib 4.6.8-5.el7, +6 more
    fixed: vendor fix RHSA-2020:3936
  • Red Hat OpenStack Platform 13.0 python-XStatic-Bootstrap-SCSS 3.4.1.0-1.el7ost, xstatic-bootstrap-scss-common 3.4.1.0-1.el7ost Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server python-XStatic-Bootstrap-SCSS 3.4.1.0-1.el7ost, xstatic-bootstrap-scss-common 3.4.1.0-1.el7ost
    fixed: vendor fix RHSA-2020:5571
  • Red Hat Process Automation 7
    fixed: vendor fix RHSA-2020:0132
  • Red Hat Single Sign-On 7.3.2 zip
    fixed: vendor fix RHSA-2019:1456
  • Red Hat RHV-M 4.3 ovirt-engine-api-explorer 0.0.4-1.el7ev, ovirt-engine-api-explorer 0.0.5-1.el7ev, ovirt-engine-ui-extensions 1.0.10-1.el7ev
    fixed: vendor fix RHBA-2019:1076
  • Red Hat CloudForms Management Engine 5 cfme-gemset Red Hat OpenShift Service Mesh 2.1 servicemesh-prometheus Red Hat 3scale API Management Platform 2 bootstrap Red Hat Discovery 1 discovery-server-container Red Hat Enterprise Linux 7 pki-ca, pki-kra, pki-base, pki-core, pki-tools, pki-server, +3 more Red Hat Enterprise Linux 8 jss, pki-ca, idm-jss, ldapjdk, pki-kra, pki-acme, +25 more
    +6 more products
    Red Hat OpenShift Container Platform 4 openshift4/ose-console Red Hat Openshift Container Storage 4 ceph Red Hat Openshift Data Foundation 4 ceph Red Hat OpenStack Platform 16.1 qpid-dispatch-tools, qpid-dispatch-router Red Hat OpenStack Platform 16.2 qpid-dispatch-tools, qpid-dispatch-router Red Hat Quay 3 quay/quay-rhel8
    not affected: vulnerable code not present

2 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.84% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N
GitHub 3.0 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm bootstrap
<3.4.0
3.4.0
npm bootstrap-sass
<3.4.0
3.4.0
packagist twbs/bootstrap
<3.4.0
3.4.0
maven org.webjars:bootstrap
<3.4.0
3.4.0
rubygems bootstrap
<3.4.0
3.4.0
rubygems bootstrap-sass
<3.4.0
3.4.0
nuget bootstrap
<3.4.0
3.4.0

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.