Bootstrap CVE-2018-14041 Cross Site Scripting Vulnerabilitiy
BID:108961
Info
Bootstrap CVE-2018-14041 Cross Site Scripting Vulnerabilitiy
| Bugtraq ID: | 108961 |
| Class: | Design Error |
| CVE: |
CVE-2018-14041 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 12 2018 12:00AM |
| Updated: | Jul 12 2018 12:00AM |
| Credit: | 1Jesper1 |
| Vulnerable: |
Redhat Single Sign-On 7.0 IBM Cloud Private 3.1.2 IBM Cloud Private 3.1.1 IBM Cloud Private 3.1.0 IBM Cloud Private 2.1.0 IBM API Connect 5.0.8.5 IBM API Connect 5.0.8.4 IBM API Connect 5.0.8.3 IBM API Connect 5.0.8.2 IBM API Connect 5.0.8.1 IBM API Connect 5.0.8.0 IBM API Connect 5.0.7.0 IBM API Connect 5.0.6.0 IBM API Connect 5.0.3.0 IBM API Connect 5.0.2.0 IBM API Connect 5.0.1.0 IBM API Connect 5.0.0.0 getbootstrap Bootstrap 4.1.1 getbootstrap Bootstrap 4.0 dotCMS dotCMS 5.1.1 |
| Not Vulnerable: |
IBM API Connect 5.0.8.6 getbootstrap Bootstrap 4.1.2 |
Discussion
Bootstrap CVE-2018-14041 Cross Site Scripting Vulnerabilitiy
Bootstrap is prone to a cross-site scripting vulnerability.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Versions prior to Bootstrap 4.1.2 are vulnerable.
Bootstrap is prone to a cross-site scripting vulnerability.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Versions prior to Bootstrap 4.1.2 are vulnerable.
Exploit / POC
Bootstrap CVE-2018-14041 Cross Site Scripting Vulnerabilitiy
Attackers can exploit this issue using a web-browser.
Attackers can exploit this issue using a web-browser.
Solution / Fix
Bootstrap CVE-2018-14041 Cross Site Scripting Vulnerabilitiy
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Bootstrap CVE-2018-14041 Cross Site Scripting Vulnerabilitiy
References:
References:
- XSS possible in data-target property of scrollspy #26627 (twbs/bootstrap)
- Bootstrap releases (getbootstrap)
- getbootstrap Homepage (getbootstrap)
- Re: dotCMS v5.1.1 HTML Injection & XSS Vulnerability (dotCMS)
- v4.1.2 ship list #26423 (getbootstrap)
- CVE-2018-14041 : Bootstrap XSS (getbootstrap)
- RHSA-2019:1456 - Security Advisory (Redhat)
- Security Bulletin: API Connect V5 is impacted by vulnerabilities in Bootstrap (C (IBM)
- Security Bulletin: IBM Cloud Private Monitoring is vulnerable to XSS attack in P (IBM)