GitHub Advisoryadvisory · npm, Maven, RubyGems, Packagist, NuGet

GHSA-4p24-vmcr-4gqj Bootstrap Cross-site Scripting vulnerability

MEDIUM Published 2019-01-17 Modified 2024-08-05 Official page ↗
Aliases
CVE-2016-10735
Ecosystem
npm, Maven, RubyGems, Packagist, NuGet
Packages
bootstrap, org.webjars:bootstrap, twbs/bootstrap, bootstrap-sass, bootstrap.sass
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• npm bootstrap: >= 2.0.4, < 3.4.0 → fixed in 3.4.0 • npm bootstrap: >= 4.0.0-beta, < 4.0.0-beta.2 → fixed in 4.0.0-beta.2 • Maven org.webjars:bootstrap: >= 2.0.4, < 3.4.0 → fixed in 3.4.0 • Maven org.webjars:bootstrap: >= 4.0.0-beta, < 4.0.0-beta.2 → fixed in 4.0.0-beta.2 • RubyGems bootstrap: < 4.0.0-beta.2 → fixed in 4.0.0-beta.2 • Packagist twbs/bootstrap: >= 2.0.4, < 3.4.0 → fixed in 3.4.0 • Packagist twbs/bootstrap: >= 4.0.0-beta, < 4.0.0-beta.2 → fixed in 4.0.0-beta.2 • NuGet bootstrap: >= 2.0.4, < 3.4.0 → fixed in 3.4.0 • NuGet bootstrap: >= 4.0.0-beta, < 4.0.0-beta.2 → fixed in 4.0.0-beta.2 • npm bootstrap-sass: >= 2.0.4, < 3.4.0 → fixed in 3.4.0 • RubyGems bootstrap-sass: >= 2.0.4, < 3.4.0 → fixed in 3.4.0 • NuGet bootstrap.sass: >= 4.0.0-beta, < 4.0.0-beta.2 → fixed in 4.0.0-beta.2

Description

In Bootstrap 2.x from 2.0.4, 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute. Note that this is a different vulnerability than CVE-2018-14041. See https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/ for more info.

Related

Alias · CVE (1)

  • CVE-2016-10735 In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References