Executive brief
Bootstrap is a popular front-end framework used to build responsive websites and web applications. This vulnerability allows attackers to inject malicious scripts through the tooltip or popover data-template attribute, potentially compromising user sessions or stealing sensitive data displayed on affected web pages.
Technical details
This is a cross-site scripting (XSS) vulnerability in Bootstrap 3 before version 3.4.1 and Bootstrap 4 before version 4.3.1. The vulnerability exists in the tooltip and popover components, which fail to properly sanitize the data-template attribute, allowing an attacker to inject arbitrary JavaScript code. The attack requires an application to use tooltips or popovers with user-controlled or unsanitized template data. An attacker can exploit this to execute arbitrary scripts in the context of a user's browser, potentially leading to session hijacking, credential theft, or malware distribution. Patches are available in Bootstrap 3.4.1 and 4.3.1.
Affected products
- Bootstrap Bootstrap 3.0.0 to 3.4.0, 4.0.0 to 4.3.0
- Bootstrap bootstrap-sass 3.0.0 to 3.4.0
Timeline
- 2019-02-22: disclosed
- 2019-02-13: patched: Bootstrap 4.3.1 and 3.4.1 released
- 2023-03-14: other: Advisory withdrawn from GitHub Advisory Database