CVE-2018-14042 — Cross-site Scripting in Bootstrap

CWE-79 — Cross-site Scripting13 documents10 sources
Severity
6.1MEDIUMNVD
EPSS
2.3%
top 15.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Getbootstrap BootstrapTwbs BootstrapTypo3 CMS+2 more
Timeline
PublishedJul 13
Latest updateFeb 24

Description

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages9 packages

▶Packagisttwbs/bootstrap4.0.0 — 4.1.2+1
▶NVDgetbootstrap/bootstrap4.0.0 — 4.1.2+2
▶NuGetgetbootstrap/bootstrap4.0.0 — 4.1.2+1
▶RubyGemsgetbootstrap/bootstrap4.0.0 — 4.1.2+1
▶npmgetbootstrap/bootstrap4.0.0 — 4.1.2+1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

6
GHSA
Bootstrap Cross-site Scripting vulnerability↗2018-09-13
▶
GHSA
Bootstrap Cross-site Scripting vulnerability↗2018-09-13
▶
OSV
Bootstrap Cross-site Scripting vulnerability↗2018-09-13
▶
OSV
Bootstrap Cross-site Scripting vulnerability↗2018-09-13
▶
OSV
CVE-2018-14042: In Bootstrap before 4↗2018-07-13
▶

📋Vendor Advisories

4
CISA ICS
Mitsubishi Electric EcoWebServerIII↗2022-02-24
▶
Microsoft
In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.↗2018-07-10
▶
Red Hat
bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip↗2018-05-29
▶
Debian
CVE-2018-14042: twitter-bootstrap3 - In Bootstrap before 4.1.2, XSS is possible in the data-container property of too...↗2018
▶

💬Community

2
HackerOne
Vulnerable javascript dependency at Main domain↗2021-08-02
▶
Bugzilla
CVE-2018-14042 bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip↗2018-07-16
▶
CVE-2018-14042 — Cross-site Scripting in Bootstrap | cvebase