In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.
Priority LOW 34CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 13 fixed, 15 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.
Why it matters now
EPSS 0.03835 90th percentileScored 2026-11-07
Fix Partial bootstrap (npm): 3.4.0bootstrap-sass (npm): 3.4.0+5 more productsRed Hat: 8 advisoriesRed Hat: 13 fixed, 15 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | bootstrap (npm) | before 3.4.0 | 3.4.0 | Patch available | GHSA-3mgp-fx93-9xv5 |
| — | bootstrap-sass (npm) | before 3.4.0 | 3.4.0 | Patch available | GHSA-3mgp-fx93-9xv5 |
| — | twbs/bootstrap (Packagist) | before 3.4.0 | 3.4.0 | Patch available | GHSA-3mgp-fx93-9xv5 |
| — | org.webjars:bootstrap (Maven) | before 3.4.0 | 3.4.0 | Patch available | GHSA-3mgp-fx93-9xv5 |
| — | bootstrap (RubyGems) | before 3.4.0 | 3.4.0 | Patch available | GHSA-3mgp-fx93-9xv5 |
| — | bootstrap-sass (RubyGems) | before 3.4.0 | 3.4.0 | Patch available | GHSA-3mgp-fx93-9xv5 |
| — | bootstrap (NuGet) | before 3.4.0 | 3.4.0 | Patch available | GHSA-3mgp-fx93-9xv5 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- bootstrap (npm) Vendor— Affected before 3.4.0 Fixed in 3.4.0 Patch available GHSA-3mgp-fx93-9xv5
- bootstrap-sass (npm) Vendor— Affected before 3.4.0 Fixed in 3.4.0 Patch available GHSA-3mgp-fx93-9xv5
- twbs/bootstrap (Packagist) Vendor— Affected before 3.4.0 Fixed in 3.4.0 Patch available GHSA-3mgp-fx93-9xv5
- org.webjars:bootstrap (Maven) Vendor— Affected before 3.4.0 Fixed in 3.4.0 Patch available GHSA-3mgp-fx93-9xv5
- bootstrap (RubyGems) Vendor— Affected before 3.4.0 Fixed in 3.4.0 Patch available GHSA-3mgp-fx93-9xv5
- bootstrap-sass (RubyGems) Vendor— Affected before 3.4.0 Fixed in 3.4.0 Patch available GHSA-3mgp-fx93-9xv5
- bootstrap (NuGet) Vendor— Affected before 3.4.0 Fixed in 3.4.0 Patch available GHSA-3mgp-fx93-9xv5
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:* | before 3.4.0 | Vulnerable | Getbootstrap |
- cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:* Versions before 3.4.0 Vulnerable ·Getbootstrap
Remediation
- Fix · GHSA-3mgp-fx93-9xv5 bootstrap (npm) Fixed in 3.4.0 Advisory →
- Fix · GHSA-3mgp-fx93-9xv5 bootstrap-sass (npm) Fixed in 3.4.0 Advisory →
- Fix · GHSA-3mgp-fx93-9xv5 twbs/bootstrap (Packagist) Fixed in 3.4.0 Advisory →
- Fix · GHSA-3mgp-fx93-9xv5 org.webjars:bootstrap (Maven) Fixed in 3.4.0 Advisory →
- Fix · GHSA-3mgp-fx93-9xv5 bootstrap (RubyGems) Fixed in 3.4.0 Advisory →
- Fix · GHSA-3mgp-fx93-9xv5 bootstrap-sass (RubyGems) Fixed in 3.4.0 Advisory →
- Fix · GHSA-3mgp-fx93-9xv5 bootstrap (NuGet) Fixed in 3.4.0 Advisory →
Red Hat 8 advisories
- RHSA-2023:5693 Released 2023-10-12 · Red Hat rating ModerateRed Hat Ceph Storage 6.1 security, enhancement, and bug fix update
- Red Hat Ceph Storage 6.1 Tools ceph-2:17.2.6-148.el9cp, ceph-base-2:17.2.6-148.el9cp, ceph-common-2:17.2.6-148.el9cp +25
- RHSA-2020:5571 Released 2020-12-16 · Red Hat rating Moderatepython-XStatic-Bootstrap-SCSS security update
- Red Hat OpenStack Platform 13.0 python-XStatic-Bootstrap-SCSS-3.4.1.0-1.el7ost, xstatic-bootstrap-scss-common-3.4.1.0-1.el7ost
- Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server python-XStatic-Bootstrap-SCSS-3.4.1.0-1.el7ost, xstatic-bootstrap-scss-common-3.4.1.0-1.el7ost
- RHSA-2020:4670 Released 2020-11-04 · Red Hat rating Moderateidm:DL1 and idm:client security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) bind-dyndb-ldap-11.3-1.module+el8.3.0+6993+104f8db0.aarch64::idm:DL1, bind-dyndb-ldap-11.3-1.module+el8.3.0+6993+104f8db0.ppc64le::idm:DL1, bind-dyndb-ldap-11.3-1.module+el8.3.0+6993+104f8db0.s390x::idm:DL1 +47
Show 5 more Red Hat advisories
- RHSA-2020:3936 Released 2020-09-29 · Red Hat rating Moderateipa security, bug fix, and enhancement update
- Red Hat Enterprise Linux Client (v. 7) ipa-4.6.8-5.el7, ipa-client-4.6.8-5.el7, ipa-client-common-4.6.8-5.el7 +4
- Red Hat Enterprise Linux Client Optional (v. 7) ipa-server-4.6.8-5.el7, ipa-server-common-4.6.8-5.el7, ipa-server-dns-4.6.8-5.el7 +2
- Red Hat Enterprise Linux ComputeNode (v. 7) ipa-4.6.8-5.el7, ipa-client-4.6.8-5.el7, ipa-client-common-4.6.8-5.el7 +4
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) ipa-server-4.6.8-5.el7, ipa-server-common-4.6.8-5.el7, ipa-server-dns-4.6.8-5.el7 +2
- Red Hat Enterprise Linux Server (v. 7) ipa-4.6.8-5.el7, ipa-client-4.6.8-5.el7, ipa-client-common-4.6.8-5.el7 +9
- Red Hat Enterprise Linux Workstation (v. 7) ipa-4.6.8-5.el7, ipa-client-4.6.8-5.el7, ipa-client-common-4.6.8-5.el7 +9
- RHSA-2020:0133 Released 2020-01-16 · Red Hat rating ModerateRed Hat Decision Manager 7.6.0 Security Update
- Red Hat Decision Manager 7
- RHSA-2020:0132 Released 2020-01-16 · Red Hat rating ModerateRed Hat Process Automation Manager 7.6.0 Security Update
- Red Hat Process Automation 7
- RHSA-2019:3023 Released 2019-10-10 · Red Hat rating Moderateovirt-engine-ui-extensions security and bug fix update
- RHV-M 4.3 ovirt-engine-ui-extensions-1.0.10-1.el7ev
- RHSA-2019:1456 Released 2019-06-11 · Red Hat rating ModerateRed Hat Single Sign-On 7.3.2 security update
- Red Hat Single Sign-On 7.3.2 zip
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ceph Storage 4 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 5 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | — |
| Red Hat Enterprise Linux 9 | Affected | — |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Web Server 2 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 14 (Rocky) | Affected | No fix yet |
| Red Hat OpenStack Platform 15 (Stein) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 8 (Liberty) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 9 (Mitaka) | Affected | No fix planned: Will not fix |
| Red Hat Satellite 6 | Affected | — |
| Red Hat Virtualization 4 | Affected | No fix planned: Out of support scope |
| RHV-M 4.3 | Fixed | RHSA-2019:3023 |
| Red Hat Decision Manager 7 | Fixed | RHSA-2020:0133 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2020:4670 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2020:3936 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2020:3936 |
| Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2020:3936 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2020:3936 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2020:3936 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2020:3936 |
| Red Hat OpenStack Platform 13.0 | Fixed | RHSA-2020:5571 |
| Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server | Fixed | RHSA-2020:5571 |
| Red Hat Process Automation 7 | Fixed | RHSA-2020:0132 |
| Red Hat Single Sign-On 7.3.2 zip | Fixed | RHSA-2019:1456 |
Not affected: 14 products
- CloudForms Management Engine 5
- OpenShift Service Mesh 2.1
- Red Hat 3scale API Management Platform 2
- Red Hat Discovery 1
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat OpenShift Container Platform 4
- Red Hat OpenStack Platform 16.1
- Red Hat OpenStack Platform 16.2
- Red Hat Openshift Container Storage 4
- Red Hat Openshift Data Foundation 4
- Red Hat Quay 3
- Red Hat Satellite 5
- Red Hat Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2018-20676
- 2026-10-03 Alias added: GHSA-3mgp-fx93-9xv5
- 2026-10-21 EPSS moved to the 90th–95th percentile
References
Advisory 11
- https://github.com/twbs/bootstrap/issues/27044
- https://github.com/twbs/bootstrap/issues/27915#issuecomment-452140906
- https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/
- https://github.com/twbs/bootstrap/issues/27915#issuecomment-452196628
- RHSA-2019:1456
- RHBA-2019:1076
- RHBA-2019:1570
- RHSA-2019:3023
- RHSA-2020:0132
- RHSA-2020:0133
- https://nvd.nist.gov/vuln/detail/CVE-2018-20676
Other 8
- [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list
- https://www.tenable.com/security/tns-2021-14
- https://github.com/twbs/bootstrap/commit/2a5ba23ce8f041f3548317acc992ed8a736b609d
- https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
- https://github.com/twbs/bootstrap
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap/CVE-2018-20676.yml
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap-sass/CVE-2018-20676.yml
- https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0
More Getbootstrap Bootstrap vulnerabilities
- TI-2019-05979 In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute. CVSS 3.1MEDIUM 6.1
- TI-2018-14682 In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property. CVSS 3.0MEDIUM 6.1
- TI-2018-10147 In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip. CVSS 3.0MEDIUM 6.1
- TI-2018-10146 In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy. CVSS 3.0MEDIUM 6.1
- TI-2018-10145 In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute. CVSS 3.0MEDIUM 6.1
- TI-2016-08775 In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the… CVSS 3.0MEDIUM 6.1
Sources
- CVE-2018-20676 · CVE Program
- CVE-2018-20676 · NVD
- FIRST EPSS
- GHSA-3mgp-fx93-9xv5 · GitHub Advisory Database · CC BY 4.0
- CVE-2018-20676 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences