CVE-2018-14040: Bootstrap Cross-Site Scripting in collapse data-parent attribute

CVE-2018-14040 · Severity: low · CVSS 3 · Published 2022-05-13

Bootstrap, a widely used web framework for designing responsive websites, is vulnerable to a security flaw that could allow attackers to execute malicious scripts in a user's browser. This occurs when the framework improperly handles certain data attributes used for collapsing page elements, tooltips, or scroll navigation. If exploited, an attacker could potentially steal user session information or perform unauthorized actions on behalf of a user visiting a compromised site.

Quick answers

Is CVE-2018-14040 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2018-14040 being exploited in the wild.
How severe is CVE-2018-14040?
Low severity, with a CVSS score of 3, published 13 May 2022.
Which products and versions are affected?
Bootstrap Bootstrap >= 2.3.0, < 3.4.0; >= 4.0.0, < 4.1.2.
Is there a fix for CVE-2018-14040?
A patch was published on 2018-07-12: Bootstrap 4.1.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-14040 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2018-14040?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in Bootstrap's JavaScript plugins, specifically affecting the 'collapse', 'tooltip', and 'scrollspy' components. The root cause is insufficient sanitization of input provided to data attributes such as 'data-parent', which are processed by jQuery selectors. An attacker can provide a specially crafted string (e.g., an img tag with an onerror attribute) that executes arbitrary JavaScript when the component is initialized or triggered. This vulnerability requires user interaction (viewing a page with the malicious attribute) and affects versions 2.3.0 through 3.3.7 and 4.0.0 through 4.1.1. The issue is resolved in versions 3.4.0 and 4.1.2.

Affected products

  • Bootstrap Bootstrap >= 2.3.0, < 3.4.0; >= 4.0.0, < 4.1.2

Identifiers

  • CVE-2018-14040
  • GHSA-3wqf-4x89-9g79

Timeline

  • 2018-04-30: other: Issue opened for v4.1.2 release planning
  • 2018-05-29: disclosed: Vulnerability reported via GitHub issue
  • 2018-07-12: patched: Bootstrap 4.1.2 released
  • 2018-07-13: advisory: NVD published CVE-2018-14040

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.