Bootstrap Vulnerable to Cross-Site Scripting

Description

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

Advisories 23

• ALSA-2020:4670 Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
• RHSA-2023:0554 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
• RHSA-2023:0552 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
• RHSA-2023:0553 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
• RHSA-2020:5571 Red Hat Security Advisory: python-XStatic-Bootstrap-SCSS security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
• RHSA-2020:4670 Red Hat Security Advisory: idm:DL1 and idm:client security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 13, 2026
• RHSA-2020:3936 Red Hat Security Advisory: ipa security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 13, 2026
• RHSA-2019:3023 Red Hat Security Advisory: ovirt-engine-ui-extensions security and bug fix update Red Hat Security Advisories (RHSA) · Oct 13, 2026
• RHSA-2020:3247 Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 9, 2026
• WID-SEC-2023-0239 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 8, 2026
• WID-SEC-2022-1947 Red Hat Single Sign On: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 8, 2026
• RHSA-2020:4847 Red Hat Security Advisory: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 8, 2026
• RHSA-2022:8865 Red Hat Security Advisory: Red Hat OpenStack 16.1.9 (python-XStatic-Bootstrap-SCSS) security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
• RHSA-2022:8848 Red Hat Security Advisory: Red Hat OpenStack 16.2.4 (python-XStatic-Bootstrap-SCSS) security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
• RHSA-2019:3024 Red Hat Security Advisory: ovirt-web-ui security and bug fix update Red Hat Security Advisories (RHSA) · Oct 2, 2026
• RLSA-2020:4847 Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 5, 2026
• RLSA-2020:4670 Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
• WID-SEC-2023-1369 IBM Business Automation Workflow: Mehrere Schwachstellen ermöglichen Cross-Site Scripting BSI CERT-Bund (WID) · Jun 5, 2023
• WID-SEC-2023-0851 IBM Maximo Asset Management: Mehrere Schwachstellen ermöglichen Cross-Site Scripting BSI CERT-Bund (WID) · Apr 4, 2023
• ELSA-2020-4847 Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 10, 2020
• ELSA-2020-4670 Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 10, 2020
• ALAS2-2020-1519 Moderate: ipa security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 22, 2020
• ELSA-2020-3936 Moderate: ipa security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 6, 2020

References

• 107375 vdb-entry
• 20190509 dotCMS v5.1.1 Vulnerabilities mailing-list
• 20190510 dotCMS v5.1.1 HTML Injection & XSS Vulnerability mailing-list
• 20190510 dotCMS v5.1.1 Vulnerabilities mailing-list
• 20190510 Re: dotCMS v5.1.1 HTML Injection & XSS Vulnerability mailing-list
• RHSA-2019:1456 vendor-advisory
• [flink-user] 20190811 Apache flink 1.7.2 security issues mailing-list
• [flink-dev] 20190811 Apache flink 1.7.2 security issues mailing-list
• [flink-user] 20190813 Apache flink 1.7.2 security issues mailing-list
• [flink-user] 20190813 Re: Apache flink 1.7.2 security issues mailing-list
• [superset-dev] 20190926 Re: [VOTE] Release Superset 0.34.1 based on Superset 0.34.1rc1 mailing-list
• RHSA-2019:3023 vendor-advisory
• RHSA-2019:3024 vendor-advisory
• [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
• [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
• [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
• http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html
• [hbase-issues] 20201116 [GitHub] [hbase] symat opened a new pull request #2661: HBASE-25261 Upgrade Bootstrap to 3.4.1 mailing-list
• [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list mailing-list
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://github.com/twbs/bootstrap/pull/28236
• https://github.com/twbs/bootstrap/releases/tag/v4.3.1
• https://blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1/
• https://github.com/twbs/bootstrap/releases/tag/v3.4.1
• https://support.f5.com/csp/article/K24383845
• https://support.f5.com/csp/article/K24383845?utm_source=f5support&amp%3Butm_medium=RSS
• https://www.tenable.com/security/tns-2021-14