Is CVE-2016-10735 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-10735 being exploited in the wild.

How severe is CVE-2016-10735?

Low severity, with a CVSS score of 3, published 17 January 2019.

Which products and versions are affected?

org.webjars:bootstrap (Maven) ECOSYSTEM:introduced=2.0.4,fixed=3.4.0; bootstrap (npm) SEMVER:introduced=2.0.4,fixed=3.4.0; bootstrap-sass (npm) SEMVER:introduced=2.0.4,fixed=3.4.0; bootstrap (NuGet) ECOSYSTEM:introduced=2.0.4,fixed=3.4.0; and 4 more.

Is there a fix for CVE-2016-10735?

Yes. org.webjars:bootstrap (Maven): upgrade to 3.4.0 or later; bootstrap (npm): upgrade to 3.4.0 or later; bootstrap-sass (npm): upgrade to 3.4.0 or later; bootstrap (NuGet): upgrade to 3.4.0 or later; bootstrap.sass (NuGet): upgrade to 4.0.0-beta.2 or later; twbs/bootstrap (Packagist): upgrade to 3.4.0 or later; bootstrap (RubyGems): upgrade to 4.0.0-beta.2 or later; bootstrap-sass (RubyGems): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-10735 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2016-10735?

Check whether you run org.webjars:bootstrap (Maven), bootstrap (npm), bootstrap-sass (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-10735: Bootstrap cross-site scripting in data-target attribute

CVE-2016-10735 · Severity: low · CVSS 3 · Published 2019-01-17

Bootstrap is a widely-used CSS and JavaScript framework for building responsive web interfaces. This vulnerability allows attackers to inject malicious JavaScript code via the data-target HTML attribute, which is used to specify collapse targets and other interactive components. An attacker can craft a malicious webpage or inject code into user-controlled data to execute arbitrary scripts in the context of a victim's browser, potentially stealing session cookies, credentials, or performing actions on their behalf.

Technologies: org.webjars:bootstrap (Maven), bootstrap (npm), bootstrap-sass (npm), bootstrap (NuGet), bootstrap.sass (NuGet), twbs/bootstrap (Packagist), bootstrap (RubyGems), bootstrap-sass (RubyGems). Vendors: Maven, npm, NuGet, Packagist, RubyGems.

Quick answers

Is CVE-2016-10735 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-10735 being exploited in the wild.
How severe is CVE-2016-10735?: Low severity, with a CVSS score of 3, published 17 January 2019.
Which products and versions are affected?: org.webjars:bootstrap (Maven) ECOSYSTEM:introduced=2.0.4,fixed=3.4.0; bootstrap (npm) SEMVER:introduced=2.0.4,fixed=3.4.0; bootstrap-sass (npm) SEMVER:introduced=2.0.4,fixed=3.4.0; bootstrap (NuGet) ECOSYSTEM:introduced=2.0.4,fixed=3.4.0; and 4 more.
Is there a fix for CVE-2016-10735?: Yes. org.webjars:bootstrap (Maven): upgrade to 3.4.0 or later; bootstrap (npm): upgrade to 3.4.0 or later; bootstrap-sass (npm): upgrade to 3.4.0 or later; bootstrap (NuGet): upgrade to 3.4.0 or later; bootstrap.sass (NuGet): upgrade to 4.0.0-beta.2 or later; twbs/bootstrap (Packagist): upgrade to 3.4.0 or later; bootstrap (RubyGems): upgrade to 4.0.0-beta.2 or later; bootstrap-sass (RubyGems): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-10735 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2016-10735?: Check whether you run org.webjars:bootstrap (Maven), bootstrap (npm), bootstrap-sass (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.webjars:bootstrap (Maven): upgrade to 3.4.0 or later

# set org.webjars:bootstrap to 3.4.0 in your pom.xml or build.gradle

bootstrap (npm): upgrade to 3.4.0 or later
```
npm install bootstrap@3.4.0
```
bootstrap-sass (npm): upgrade to 3.4.0 or later
```
npm install bootstrap-sass@3.4.0
```

bootstrap (NuGet): upgrade to 3.4.0 or later

dotnet add package bootstrap --version 3.4.0

bootstrap.sass (NuGet): upgrade to 4.0.0-beta.2 or later

dotnet add package bootstrap.sass --version 4.0.0-beta.2

twbs/bootstrap (Packagist): upgrade to 3.4.0 or later
```
composer require twbs/bootstrap:^3.4.0
```
bootstrap (RubyGems): upgrade to 4.0.0-beta.2 or later
```
bundle update bootstrap
```
bootstrap-sass (RubyGems): upgrade to 3.4.0 or later
```
bundle update bootstrap-sass
```

Technical details

This is a cross-site scripting (XSS) vulnerability in Bootstrap's handling of the data-target attribute, a jQuery data attribute used for dynamic collapse and tab navigation. The vulnerable code fails to sanitize or escape the data-target value before using it in DOM operations, allowing an attacker to inject arbitrary HTML and JavaScript. The vulnerability affects Bootstrap 2.x (from 2.0.4 onwards), 3.x (before 3.4.0), and 4.x-beta (before 4.0.0-beta.2). Attack vector is network-based with user interaction required (victim must visit a malicious page or have untrusted data rendered in data-target). An attacker can execute arbitrary JavaScript in the victim's browser context. Patches were released in Bootstrap 3.4.0 and 4.0.0-beta.2, with fixes backported to later versions.

Affected products

Bootstrap Bootstrap 2.0.4 to 3.3.7, 4.0.0-beta to 4.0.0-beta.1
Bootstrap bootstrap-sass 2.0.4 to 3.3.7, 4.0.0-beta

Identifiers

CVE-2016-10735
GHSA-4p24-vmcr-4gqj

Timeline

2016-06-27: disclosed: XSS in data-target attribute reported on GitHub issue #20184
2017-08-25: patched: Fix merged for v4 via PR #23679
2017-09-14: patched: Fix merged for v3 via PR #23687
2018-05-07: patched: Additional fix for tabs via PR #26460 in v3.4.0-dev
2019-01-09: advisory: CVE-2016-10735 published on NVD
2019-01-17: advisory: GHSA-4p24-vmcr-4gqj published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.