GitHub Advisoryadvisory · npm, Packagist, RubyGems, NuGet, Maven

GHSA-pj7m-g53m-7638 Bootstrap Cross-site Scripting vulnerability

MEDIUM Published 2018-09-13 Modified 2025-11-19 Official page ↗
Aliases
CVE-2018-14041
Ecosystem
npm, Packagist, RubyGems, NuGet, Maven
Packages
bootstrap, typo3/cms-core, typo3/cms, twbs/bootstrap, bootstrap.sass, org.webjars:bootstrap
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• npm bootstrap: >= 4.0.0, < 4.1.2 → fixed in 4.1.2 • Packagist typo3/cms-core: >= 8.0.0, < 8.7.23 → fixed in 8.7.23 • Packagist typo3/cms-core: >= 9.0.0, < 9.5.4 → fixed in 9.5.4 • Packagist typo3/cms: >= 8.0.0, < 8.7.23 → fixed in 8.7.23 • Packagist typo3/cms: >= 9.0.0, < 9.5.4 → fixed in 9.5.4 • RubyGems bootstrap: >= 4.0.0, < 4.1.2 → fixed in 4.1.2 • Packagist twbs/bootstrap: >= 4.0.0, < 4.1.2 → fixed in 4.1.2 • NuGet bootstrap: >= 4.0.0, < 4.1.2 → fixed in 4.1.2 • NuGet bootstrap.sass: >= 4.0.0, < 4.1.2 → fixed in 4.1.2 • Maven org.webjars:bootstrap: >= 4.0.0, < 4.1.2 → fixed in 4.1.2

Description

In Bootstrap 4.x before 4.1.2, XSS is possible in the data-target property of scrollspy. This is similar to CVE-2018-14042.

Related

Alias · CVE (1)

  • CVE-2018-14041 In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References