~ / search / GHSA-3wqf-4x89-9g79

GHSA-3wqf-4x89-9g79

Bootstrap vulnerable to Cross-Site Scripting (XSS)

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-14040

Packages

EcosystemPackageAffectedFixed in
npm bootstrap >= 4.0.0, < 4.1.2 4.1.2
RubyGems bootstrap >= 4.0.0, < 4.1.2 4.1.2
npm bootstrap >= 2.3.0, < 3.4.0 3.4.0
RubyGems bootstrap >= 2.3.0, < 3.4.0 3.4.0
Maven org.webjars:bootstrap >= 4.0.0, < 4.1.2 4.1.2
Maven org.webjars:bootstrap >= 2.3.0, < 3.4.0 3.4.0
NuGet bootstrap >= 2.3.0, < 3.4.0 3.4.0
NuGet bootstrap >= 4.0.0, < 4.1.2 4.1.2
NuGet bootstrap.sass >= 4.0.0, < 4.1.2 4.1.2
RubyGems bootstrap-sass >= 2.3.0, < 3.4.0 3.4.0
Packagist twbs/bootstrap >= 2.3.0, < 3.4.0 3.4.0
Packagist twbs/bootstrap >= 4.0.0, < 4.1.2 4.1.2

Details

As written in the advisory (Markdown source, shown as plain text).

In Bootstrap starting in version 2.3.0 and prior to 3.4.0, as well as 4.x before 4.1.2, XSS is possible in the collapse data-parent attribute.

References

External links from the advisory. They lead to third-party sites.