Bootstrap - Critical - Information Disclosure - SA-CONTRIB-2017-048

This theme enables you to bridge the gap between the Bootstrap Framework and Drupal.

The theme does not sufficiently exclude the submitted password value when an incorrect value has been submitted

Versions affected

• bootstrap 8.x-3.x versions prior to 8.x-3.5.

Drupal core is not affected. If you do not use the contributed Bootstrap module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the bootstrap theme for Drupal 8.x, upgrade to bootstrap 8.x-3.5

Also see the Bootstrap project page.

Reported by

• Joan Ruiz (jruma)

Fixed by

• Mark Carver (markcarver) the theme maintainer

Coordinated by

• Michael Hess of the Drupal Security Team