GitHub Advisoryadvisory · npm, RubyGems, Maven, NuGet, Packagist

GHSA-3wqf-4x89-9g79 Bootstrap vulnerable to Cross-Site Scripting (XSS)

MEDIUM Published 2022-05-13 Modified 2024-08-05 Official page ↗
Aliases
CVE-2018-14040
Ecosystem
npm, RubyGems, Maven, NuGet, Packagist
Packages
bootstrap, org.webjars:bootstrap, bootstrap.sass, bootstrap-sass, twbs/bootstrap
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-09-15

Affected packages

• npm bootstrap: >= 4.0.0, < 4.1.2 → fixed in 4.1.2 • RubyGems bootstrap: >= 4.0.0, < 4.1.2 → fixed in 4.1.2 • npm bootstrap: >= 2.3.0, < 3.4.0 → fixed in 3.4.0 • RubyGems bootstrap: >= 2.3.0, < 3.4.0 → fixed in 3.4.0 • Maven org.webjars:bootstrap: >= 4.0.0, < 4.1.2 → fixed in 4.1.2 • Maven org.webjars:bootstrap: >= 2.3.0, < 3.4.0 → fixed in 3.4.0 • NuGet bootstrap: >= 2.3.0, < 3.4.0 → fixed in 3.4.0 • NuGet bootstrap: >= 4.0.0, < 4.1.2 → fixed in 4.1.2 • NuGet bootstrap.sass: >= 4.0.0, < 4.1.2 → fixed in 4.1.2 • RubyGems bootstrap-sass: >= 2.3.0, < 3.4.0 → fixed in 3.4.0 • Packagist twbs/bootstrap: >= 2.3.0, < 3.4.0 → fixed in 3.4.0 • Packagist twbs/bootstrap: >= 4.0.0, < 4.1.2 → fixed in 4.1.2

Description

In Bootstrap starting in version 2.3.0 and prior to 3.4.0, as well as 4.x before 4.1.2, XSS is possible in the collapse data-parent attribute.

Related

Alias · CVE (1)

  • CVE-2018-14040 In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References