CVE-2018-14040 — Cross-site Scripting in Bootstrap

CWE-79 — Cross-site Scripting11 documents10 sources
Severity
6.1MEDIUMNVD
EPSS
2.8%
top 13.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Getbootstrap BootstrapTwbs BootstrapBootstrap-sass+1 more
Timeline
PublishedJul 13
Latest updateMay 13

Description

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages6 packages

▶Packagisttwbs/bootstrap2.3.0 — 3.4.0+1
▶NVDgetbootstrap/bootstrap4.0.0 — 4.1.2+2
▶NuGetgetbootstrap/bootstrap2.3.0 — 3.4.0+1
▶RubyGemsgetbootstrap/bootstrap4.0.0 — 4.1.2+1
▶npmgetbootstrap/bootstrap4.0.0 — 4.1.2+1

Also affects: Debian Linux 8.0

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
Bootstrap vulnerable to Cross-Site Scripting (XSS)↗2022-05-13
▶
GHSA
Bootstrap vulnerable to Cross-Site Scripting (XSS)↗2022-05-13
▶
OSV
CVE-2018-14040: In Bootstrap before 4↗2018-07-13
▶
CVEList
CVE-2018-14040: In Bootstrap before 4↗2018-07-13
▶

📋Vendor Advisories

4
CISA ICS
Mitsubishi Electric EcoWebServerIII↗2022-02-24
▶
Microsoft
In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attributeIn Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute↗2018-07-10
▶
Red Hat
bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute↗2018-05-29
▶
Debian
CVE-2018-14040: twitter-bootstrap3 - In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute...↗2018
▶

💬Community

2
HackerOne
Vulnerable javascript dependency at Main domain↗2021-08-02
▶
Bugzilla
CVE-2018-14040 bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute↗2018-07-16
▶
CVE-2018-14040 — Cross-site Scripting in Bootstrap | cvebase