Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2018-14040GHSA-3WQF-4X89-9G79

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 4.1.2, 3.4.0
2 proofs of concept on GitHub

Summary

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • n/a n/a

    Version range not reported

  • bootstrapnpm

    From 4.0.0 · fixed in 4.1.2

  • bootstrapRubyGems

    From 4.0.0 · fixed in 4.1.2

  • bootstrapnpm

    From 2.3.0 · fixed in 3.4.0

  • bootstrapRubyGems

    From 2.3.0 · fixed in 3.4.0

  • org.webjars:bootstrapMaven

    From 4.0.0 · fixed in 4.1.2

  • org.webjars:bootstrapMaven

    From 2.3.0 · fixed in 3.4.0

  • bootstrapNuGet

    From 2.3.0 · fixed in 3.4.0

  • bootstrapNuGet

    From 4.0.0 · fixed in 4.1.2

  • bootstrap.sassNuGet

    From 4.0.0 · fixed in 4.1.2

  • bootstrap-sassRubyGems

    From 2.3.0 · fixed in 3.4.0

  • twbs/bootstrapPackagist

    From 2.3.0 · fixed in 3.4.0

  • twbs/bootstrapPackagist

    From 4.0.0 · fixed in 4.1.2

References 21

lists.debian.org

seclists.org

lists.apache.org

packetstormsecurity.com

oracle.com

GitHub · twbs/bootstrap

blog.getbootstrap.com

tenable.com

GitHub · Snorlyd/https-nj.gov---CVE-2018-14040

GitHub · Yumeae/Bootstrap-with-XSS