GHSA-9v3m-8fp8-mj99
Suggest an improvement- Source
- https://github.com/advisories/GHSA-9v3m-8fp8-mj99
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-9v3m-8fp8-mj99/GHSA-9v3m-8fp8-mj99.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-9v3m-8fp8-mj99
- Aliases
- Published
- 2019-02-22T20:54:47Z
- Modified
- 2024-08-01T21:35:26.201564Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- Bootstrap Vulnerable to Cross-Site Scripting
- Details
-
Versions of
bootstrapprior to 3.4.1 for 3.x and 4.3.1 for 4.x are vulnerable to Cross-Site Scripting (XSS). Thedata-templateattribute of the tooltip and popover plugins lacks input sanitization and may allow attacker to execute arbitrary JavaScript.Recommendation
For
bootstrap4.x upgrade to 4.3.1 or later. Forbootstrap3.x upgrade to 3.4.1 or later. - References
-
- https://nvd.nist.gov/vuln/detail/CVE-2019-8331
- https://github.com/twbs/bootstrap/pull/28236
- https://access.redhat.com/errata/RHSA-2019:1456
- https://lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e@%3Cdev.superset.apache.org%3E
- https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854%40%3Cuser.flink.apache.org%3E
- https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854@%3Cuser.flink.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/r3dc0cac8d856bca02bd6997355d7ff83027dcfc82f8646a29b89b714%40%3Cissues.hbase.apache.org%3E
- https://lists.apache.org/thread.html/r3dc0cac8d856bca02bd6997355d7ff83027dcfc82f8646a29b89b714@%3Cissues.hbase.apache.org%3E
- https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
- https://seclists.org/bugtraq/2019/May/18
- https://support.f5.com/csp/article/K24383845
- https://support.f5.com/csp/article/K24383845?utm_source=f5support&%3Butm_medium=RSS
- https://support.f5.com/csp/article/K24383845?utm_source=f5support&utm_medium=RSS
- https://web.archive.org/web/20200227083900/http://www.securityfocus.com/bid/107375
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.tenable.com/security/tns-2021-14
- https://access.redhat.com/errata/RHSA-2019:3023
- https://access.redhat.com/errata/RHSA-2019:3024
- https://blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8331
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap/CVE-2019-8331.yml
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/twitter-bootstrap-rails/CVE-2019-8331.yml
- https://github.com/seyhunak/twitter-bootstrap-rails/tree/master/app/assets/javascripts/twitter/bootstrap
- https://github.com/twbs/bootstrap
- https://github.com/twbs/bootstrap/releases/tag/v3.4.1
- https://github.com/twbs/bootstrap/releases/tag/v4.3.1
- https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731%40%3Cdev.flink.apache.org%3E
- https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731@%3Cdev.flink.apache.org%3E
- https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49%40%3Cuser.flink.apache.org%3E
- https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49@%3Cuser.flink.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2%40%3Cuser.flink.apache.org%3E
- https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2@%3Cuser.flink.apache.org%3E
- https://lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e%40%3Cdev.superset.apache.org%3E
- http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html
- http://seclists.org/fulldisclosure/2019/May/10
- http://seclists.org/fulldisclosure/2019/May/11
- http://seclists.org/fulldisclosure/2019/May/13
Affected packages
RubyGems / bootstrap
Package
- Name
- bootstrap
- Purl
- pkg:gem/bootstrap
RubyGems / bootstrap-sass
Package
- Name
- bootstrap-sass
- Purl
- pkg:gem/bootstrap-sass
NuGet / Bootstrap.Less
Package
- Name
- Bootstrap.Less
- View open source insights on deps.dev
- Purl
- pkg:nuget/Bootstrap.Less
NuGet / bootstrap
Package
- Name
- bootstrap
- View open source insights on deps.dev
- Purl
- pkg:nuget/bootstrap
NuGet / bootstrap
Package
- Name
- bootstrap
- View open source insights on deps.dev
- Purl
- pkg:nuget/bootstrap
NuGet / bootstrap.sass
Package
- Name
- bootstrap.sass
- View open source insights on deps.dev
- Purl
- pkg:nuget/bootstrap.sass
npm / bootstrap
Package
- Name
- bootstrap
- View open source insights on deps.dev
- Purl
- pkg:npm/bootstrap
npm / bootstrap
Package
- Name
- bootstrap
- View open source insights on deps.dev
- Purl
- pkg:npm/bootstrap
npm / bootstrap-sass
Package
- Name
- bootstrap-sass
- View open source insights on deps.dev
- Purl
- pkg:npm/bootstrap-sass
RubyGems / twitter-bootstrap-rails
Package
- Name
- twitter-bootstrap-rails
- Purl
- pkg:gem/twitter-bootstrap-rails
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedLast affected5.0.0
Affected versions
0.*
0.0.3
0.0.4
0.0.5
1.*
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.4.3
2.*
2.0rc0
2.0
2.0.0
2.0.1
2.0.1.0
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.2.8
3.*
3.2.0
3.2.1.rc1
3.2.2
4.*
4.0.0
5.*
5.0.0
Maven / org.webjars:bootstrap
Package
- Name
- org.webjars:bootstrap
- View open source insights on deps.dev
- Purl
- pkg:maven/org.webjars/bootstrap
Maven / org.webjars:bootstrap
Package
- Name
- org.webjars:bootstrap
- View open source insights on deps.dev
- Purl
- pkg:maven/org.webjars/bootstrap
Packagist / twbs/bootstrap
Package
- Name
- twbs/bootstrap
- Purl
- pkg:composer/twbs/bootstrap
Packagist / twbs/bootstrap
Package
- Name
- twbs/bootstrap
- Purl
- pkg:composer/twbs/bootstrap