~ / search / GHSA-pj7m-g53m-7638

GHSA-pj7m-g53m-7638

Bootstrap Cross-site Scripting vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-14041

Packages

EcosystemPackageAffectedFixed in
npm bootstrap >= 4.0.0, < 4.1.2 4.1.2
Packagist typo3/cms-core >= 8.0.0, < 8.7.23 8.7.23
Packagist typo3/cms-core >= 9.0.0, < 9.5.4 9.5.4
Packagist typo3/cms >= 8.0.0, < 8.7.23 8.7.23
Packagist typo3/cms >= 9.0.0, < 9.5.4 9.5.4
RubyGems bootstrap >= 4.0.0, < 4.1.2 4.1.2
Packagist twbs/bootstrap >= 4.0.0, < 4.1.2 4.1.2
NuGet bootstrap >= 4.0.0, < 4.1.2 4.1.2
NuGet bootstrap.sass >= 4.0.0, < 4.1.2 4.1.2
Maven org.webjars:bootstrap >= 4.0.0, < 4.1.2 4.1.2

Details

As written in the advisory (Markdown source, shown as plain text).

In Bootstrap 4.x before 4.1.2, XSS is possible in the data-target property of scrollspy. This is similar to CVE-2018-14042.

References

External links from the advisory. They lead to third-party sites.