Summary
It was discovered that Bootstrap did not correctly sanitize certain input in
the carousel component. An attacker could possibly use this issue to execute a
cross-site scripting (XSS) attack. (CVE-2024-6484, CVE-2024-6531)
It was discovered that Bootstrap did not correctly sanitize certain input in
the button plugin. An attacker could possibly use this issue to execute a
cross-site scripting (XSS) attack. (CVE-2024-6485)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | twitter-bootstrap3 | 3.4.1+dfsg-2+deb11u2build0.22.04.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | twitter-bootstrap3 | 3.4.1+dfsg-3+deb12u1build0.24.04.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | twitter-bootstrap4 | 4.6.1+dfsg1-4+deb12u1build0.24.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | twitter-bootstrap3 | 3.3.6+dfsg-1ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | twitter-bootstrap3 | 3.3.7+dfsg-2ubuntu0.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | twitter-bootstrap3 | 3.4.1+dfsg-1ubuntu0.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | twitter-bootstrap4 | 4.4.1+dfsg1-2ubuntu0.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | twitter-bootstrap4 | 4.6.0+dfsg1-4ubuntu0.1~esm1 |
Vulnerabilities 3
-
Medium 6.4CVE-2024-6485 Public exploit
XSS in Bootstrap button component
A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting mal…
-
Unscored —CVE-2024-6484 Rejected
This was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally …
-
Unscored —CVE-2024-6531 Rejected
This was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally …