CVE-2018-14041 — Cross-site Scripting in Bootstrap

CWE-79 — Cross-site Scripting18 documents8 sources
Severity
6.1MEDIUMNVD
EPSS
7.7%
top 8.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Getbootstrap BootstrapTwbs BootstrapTypo3 CMS+2 more
Timeline
PublishedJul 13
Latest updateAug 2

Description

In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages9 packages

▶Packagisttwbs/bootstrap2.0.4 — 3.4.0+3
▶NVDgetbootstrap/bootstrap3.0.0 — 3.4.0+2
▶NuGetgetbootstrap/bootstrap2.0.4 — 3.4.0+3
▶RubyGemsgetbootstrap/bootstrap4.0.0 — 4.1.2+2
▶npmgetbootstrap/bootstrap2.0.4 — 3.4.0+3

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

9
GHSA
Bootstrap Cross-site Scripting vulnerability↗2019-01-17
▶
OSV
Bootstrap Cross-site Scripting vulnerability↗2019-01-17
▶
OSV
CVE-2016-10735: In Bootstrap 3↗2019-01-09
▶
CVEList
CVE-2016-10735: In Bootstrap 3↗2019-01-09
▶
GHSA
Bootstrap Cross-site Scripting vulnerability↗2018-09-13
▶

📋Vendor Advisories

4
Red Hat
bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy↗2018-05-29
▶
Debian
CVE-2018-14041: twitter-bootstrap3 - In Bootstrap before 4.1.2, XSS is possible in the data-target property of scroll...↗2018
▶
Red Hat
bootstrap: XSS in the data-target attribute↗2016-06-27
▶
Debian
CVE-2016-10735: twitter-bootstrap3 - In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible ...↗2016
▶

💬Community

3
HackerOne
Vulnerable javascript dependency at Main domain↗2021-08-02
▶
Bugzilla
CVE-2016-10735 bootstrap: XSS in the data-target attribute↗2019-01-21
▶
Bugzilla
CVE-2018-14041 bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy↗2018-07-16
▶
CVE-2018-14041 — Cross-site Scripting in Bootstrap | cvebase