XSS Vulnerability in Twitter Bootstrap 3.x and 4.x - CVE-2016-10735
Summary
CVE-2016-10735: In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041. Affects twitter-bootstrap3 across 2 version ranges.
< 3.4.0+dfsg-1
>= e8a1df5f060bf7e6631554648e0abde150aedbe4, < 4c547f2175b9a05aa43551f6927da83fe249ce42
Fixed in 3.4.0+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Twitter Bootstrap is a popular open-source front-end framework used for developing responsive and mobile-first websites. It provides a collection of CSS and JavaScript components that help developers create visually appealing and functional web applications. The framework has undergone various updates, with versions 3.x and 4.x being widely utilized. However, certain versions of Bootstrap are vulnerable to cross-site scripting (XSS) attacks, particularly through the data-target attribute, which can lead to security breaches if not addressed.
Vulnerability Detail
CVE-2016-10735 is a cross-site scripting (XSS) vulnerability found in Bootstrap versions 3.x prior to 3.4.0 and 4.x-beta prior to 4.0.0-beta.2. The vulnerability arises from improper handling of the data-target attribute, allowing attackers to inject malicious scripts into web pages. This can result in unauthorized access to user data, session hijacking, or other malicious activities. The vulnerability is distinct from CVE-2018-14041 and poses a significant risk to applications using affected versions of Bootstrap.
How To Fix
Minimum fixed version
3.4.0+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade twitter-bootstrap3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, consider sanitizing user inputs that interact with the data-target attribute to prevent XSS attacks. Implementing a Content Security Policy (CSP) can also help mitigate the risk by restricting the sources from which scripts can be executed.
Conclusion
CVE-2016-10735 is a significant XSS vulnerability in Bootstrap that can compromise the security of web applications. It is crucial for developers to upgrade to the latest version of Bootstrap to mitigate this risk. Additionally, implementing workarounds such as input sanitization and CSP can provide temporary relief until an upgrade can be performed.
See every vulnerability recorded for twitter-bootstrap3 →
FAQ
CVE-2016-10735 is a cross-site scripting (XSS) vulnerability in Bootstrap that affects versions 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2.
If exploited, this vulnerability can allow attackers to inject malicious scripts, potentially leading to unauthorized access to sensitive user information or session hijacking.
Bootstrap versions 3.x prior to 3.4.0 and 4.x-beta prior to 4.0.0-beta.2 are affected by this vulnerability.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score for CVE-2016-10735 is 6.1, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for twitter-bootstrap3.
