bootstrap vulnerabilities and fixes

Recent CVEs affecting bootstrap, with upgrade or downgrade steps. 7 tracked.

bootstrap has 7 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 7. Most recent: 2019-02-20. Highest priority: CVE-2018-14040 (score 54/100).

• CVE-2019-8331 MEDIUM 6.1 UPGRADE UPGRADE In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attr
• CVE-2018-20677 MEDIUM 6.1 UPGRADE In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.
• CVE-2018-20676 MEDIUM 6.1 UPGRADE In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.
• CVE-2018-14042 MEDIUM 6.1 UPGRADE In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.
• CVE-2018-14041 MEDIUM 6.1 UPGRADE In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.
• CVE-2018-14040 MEDIUM 6.1 MITIGATE UPGRADE In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.
• CVE-2016-10735 MEDIUM 6.1 UPGRADE In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute,

FAQ

How do I fix bootstrap vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is bootstrap being exploited right now?

None of the tracked bootstrap CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which bootstrap CVE should I patch first?

CVE-2018-14040 currently ranks highest (54/100): In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute..

RSS feed for bootstrap · ← Back to latest CVEs