// For flags

CVE-2018-20676

bootstrap: XSS in the tooltip data-viewport attribute

Severity Score

6.1
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.

En Bootstrap, en versiones anteriores a la 3.4.0, Cross-Site Scripting (XSS) es posible en el atributo "data-viewport".

A flaw was found in Bootstrap, where it is vulnerable to Cross-site scripting, caused by improper validation of user-supplied input by the tooltip data-viewport attribute. This flaw allows a remote attacker to execute a script in a victim's Web browser within the security context of the hosting Web site, which can lead to stealing the victim's cookie-based authentication credentials.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-05-07 First Exploit
  • 2019-01-08 CVE Reserved
  • 2019-01-09 CVE Published
  • 2024-08-05 CVE Updated
  • 2024-08-13 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Getbootstrap
Search vendor "Getbootstrap"
 Bootstrap
Search vendor "Getbootstrap" for product "Bootstrap"
 < 3.4.0
Search vendor "Getbootstrap" for product "Bootstrap" and version " < 3.4.0"
-
Affected