// For flags

CVE-2018-14040

bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute

Severity Score

6.1
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

3
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

En Bootstrap en versiones anteriores a la 4.1.2, es posible Cross-Site Scripting (XSS) en el atributo collapse data-parent.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-05-07 First Exploit
  • 2018-07-13 CVE Reserved
  • 2018-07-13 CVE Published
  • 2024-01-13 EPSS Updated
  • 2024-08-05 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (23)
URL Tag Source
http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html X_refsource_misc
http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html X_refsource_misc
http://seclists.org/fulldisclosure/2019/May/10 Mailing List
http://seclists.org/fulldisclosure/2019/May/11 Mailing List
http://seclists.org/fulldisclosure/2019/May/13 Mailing List
https://github.com/twbs/bootstrap/issues/26423 Issue Tracking
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E Mailing List
https://lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e%40%3Cdev.superset.apache.org%3E Mailing List
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E Mailing List
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r3dc0cac8d856bca02bd6997355d7ff83027dcfc82f8646a29b89b714%40%3Cissues.hbase.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E Mailing List
https://lists.debian.org/debian-lts-announce/2018/08/msg00027.html Mailing List
https://seclists.org/bugtraq/2019/May/18 Mailing List
https://www.oracle.com/security-alerts/cpuApr2021.html X_refsource_misc
https://www.tenable.com/security/tns-2021-14 X_refsource_confirm
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Debian
Search vendor "Debian"
Debian Linux
Search vendor "Debian" for product "Debian Linux"
8.0
Search vendor "Debian" for product "Debian Linux" and version "8.0"
-
Affected
Getbootstrap
Search vendor "Getbootstrap"
Bootstrap
Search vendor "Getbootstrap" for product "Bootstrap"
< 3.4.0
Search vendor "Getbootstrap" for product "Bootstrap" and version " < 3.4.0"
-
Affected
Getbootstrap
Search vendor "Getbootstrap"
Bootstrap
Search vendor "Getbootstrap" for product "Bootstrap"
>= 4.0.0 < 4.1.2
Search vendor "Getbootstrap" for product "Bootstrap" and version " >= 4.0.0 < 4.1.2"
-
Affected
Getbootstrap
Search vendor "Getbootstrap"
Bootstrap
Search vendor "Getbootstrap" for product "Bootstrap"
4.0.0
Search vendor "Getbootstrap" for product "Bootstrap" and version "4.0.0"
alpha
Affected
Getbootstrap
Search vendor "Getbootstrap"
Bootstrap
Search vendor "Getbootstrap" for product "Bootstrap"
4.0.0
Search vendor "Getbootstrap" for product "Bootstrap" and version "4.0.0"
alpha2
Affected
Getbootstrap
Search vendor "Getbootstrap"
Bootstrap
Search vendor "Getbootstrap" for product "Bootstrap"
4.0.0
Search vendor "Getbootstrap" for product "Bootstrap" and version "4.0.0"
alpha3
Affected
Getbootstrap
Search vendor "Getbootstrap"
Bootstrap
Search vendor "Getbootstrap" for product "Bootstrap"
4.0.0
Search vendor "Getbootstrap" for product "Bootstrap" and version "4.0.0"
alpha4
Affected
Getbootstrap
Search vendor "Getbootstrap"
Bootstrap
Search vendor "Getbootstrap" for product "Bootstrap"
4.0.0
Search vendor "Getbootstrap" for product "Bootstrap" and version "4.0.0"
alpha5
Affected
Getbootstrap
Search vendor "Getbootstrap"
Bootstrap
Search vendor "Getbootstrap" for product "Bootstrap"
4.0.0
Search vendor "Getbootstrap" for product "Bootstrap" and version "4.0.0"
alpha6
Affected
Getbootstrap
Search vendor "Getbootstrap"
Bootstrap
Search vendor "Getbootstrap" for product "Bootstrap"
4.0.0
Search vendor "Getbootstrap" for product "Bootstrap" and version "4.0.0"
beta
Affected
Getbootstrap
Search vendor "Getbootstrap"
Bootstrap
Search vendor "Getbootstrap" for product "Bootstrap"
4.0.0
Search vendor "Getbootstrap" for product "Bootstrap" and version "4.0.0"
beta2
Affected
Getbootstrap
Search vendor "Getbootstrap"
Bootstrap
Search vendor "Getbootstrap" for product "Bootstrap"
4.0.0
Search vendor "Getbootstrap" for product "Bootstrap" and version "4.0.0"
beta3
Affected