CVE-2016-10735

bootstrap: XSS in the data-target attribute

Severity Score

6.1

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

En las versiones de Bootstrap anteriores a la 3.4.0 y en las 4.x-beta anteriores a la 4.0.0-beta.2, Cross-Site Scripting (XSS) es posible en el atributo "data-target". Se trata de una vulnerabilidad diferente de CVE-2018-14041.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2017-08-25 First Exploit
2019-01-08 CVE Reserved
2019-01-09 CVE Published
2024-08-06 CVE Updated
2024-08-28 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (16)

URL	Tag	Source
https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0	Release Notes
https://github.com/twbs/bootstrap/issues/27915#issuecomment-452140906	Issue Tracking
https://github.com/twbs/bootstrap/pull/23679	Third Party Advisory
https://github.com/twbs/bootstrap/pull/26460	Third Party Advisory
https://www.tenable.com/security/tns-2021-14	X_refsource_confirm

URL	Date	SRC
https://github.com/ossf-cve-benchmark/CVE-2016-10735	2017-08-25
https://github.com/twbs/bootstrap/issues/20184	2024-08-06

URL	Date	SRC
https://github.com/twbs/bootstrap/pull/23687	2021-07-22

URL	Date	SRC
https://access.redhat.com/errata/RHBA-2019:1076	2021-07-22
https://access.redhat.com/errata/RHBA-2019:1570	2021-07-22
https://access.redhat.com/errata/RHSA-2019:1456	2021-07-22
https://access.redhat.com/errata/RHSA-2019:3023	2021-07-22
https://access.redhat.com/errata/RHSA-2020:0132	2021-07-22
https://access.redhat.com/errata/RHSA-2020:0133	2021-07-22
https://access.redhat.com/security/cve/CVE-2016-10735	2023-01-31
https://bugzilla.redhat.com/show_bug.cgi?id=1668097	2023-01-31

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Getbootstrap Search vendor "Getbootstrap"		Bootstrap Search vendor "Getbootstrap" for product "Bootstrap"				>= 3.0.0 < 3.4.0 Search vendor "Getbootstrap" for product "Bootstrap" and version " >= 3.0.0 < 3.4.0"		-		Affected
Getbootstrap Search vendor "Getbootstrap"		Bootstrap Search vendor "Getbootstrap" for product "Bootstrap"				4.0.0 Search vendor "Getbootstrap" for product "Bootstrap" and version "4.0.0"		beta		Affected