PT-2019-5302 · Twitter+4 · Bootstrap+4

CVE-2019-8331

·

Publicado

2019-02-20

·

Atualizado

2026-07-16

CVSS v3.1

6.1

Média

VetorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Bootstrap versions prior to 3.4.1 for 3.x and 4.3.1 for 4.x
Description The issue is related to Cross-Site Scripting (XSS) in the tooltip or popover data-template attribute of the Bootstrap toolkit. This is due to a lack of input sanitization, which may allow an attacker to execute arbitrary JavaScript. The vulnerability can be exploited by a remote attacker to perform cross-site scripting attacks.
Recommendations For Bootstrap 4.x, upgrade to 4.3.1 or later. For Bootstrap 3.x, upgrade to 3.4.1 or later.

Exploit

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

ALSA-2020:4670
ALSA-2025_16880
BDU:2020-02249
CESA-2020_3936
CESA-2020_4670
CESA-2020_4847
CVE-2019-8331
GHSA-9V3M-8FP8-MJ99
RHSA-2019:3023
RHSA-2019:3024
RHSA-2020:3247
RHSA-2020:3936
RHSA-2020:4670
RHSA-2020:4847
RHSA-2020:5571
RHSA-2020_3936
RHSA-2020_4670
RHSA-2020_4847
RHSA-2022:8848
RHSA-2022:8865
RHSA-2023:0552
RHSA-2023:0553
RHSA-2023:0554
RLSA-2020:4670
RLSA-2020:4847

Produtos afetados

Almalinux
Bootstrap
Centos
Red Hat
Rocky Linux