CVE-2018-14041GHSA-PJ7M-G53M-7638
In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.1.2, 8.7.23, 9.5.4
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
Summary
In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.
Timeline
- CVE published
- Record last updated
Affected versions
- n/a n/a
Version range not reported
- bootstrapnpm
From 4.0.0 · fixed in 4.1.2
- typo3/cms-corePackagist
From 8.0.0 · fixed in 8.7.23
- typo3/cms-corePackagist
From 9.0.0 · fixed in 9.5.4
- typo3/cmsPackagist
From 8.0.0 · fixed in 8.7.23
- typo3/cmsPackagist
From 9.0.0 · fixed in 9.5.4
- bootstrapRubyGems
From 4.0.0 · fixed in 4.1.2
- twbs/bootstrapPackagist
From 4.0.0 · fixed in 4.1.2
- bootstrapNuGet
From 4.0.0 · fixed in 4.1.2
- bootstrap.sassNuGet
From 4.0.0 · fixed in 4.1.2
- org.webjars:bootstrapMaven
From 4.0.0 · fixed in 4.1.2
References 18
seclists.org
access.redhat.com
lists.apache.org
- thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e@<dev.superset.apache.org>
- thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@<dev.drill.apache.org>
- thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@<dev.drill.apache.org>
- thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@<issues.drill.apache.org>
- thread.html/r3dc0cac8d856bca02bd6997355d7ff83027dcfc82f8646a29b89b714@<issues.hbase.apache.org>