Is CVE-2019-8331 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-8331 being exploited in the wild.

How severe is CVE-2019-8331?

Medium severity, with a CVSS score of 6.1, published 22 February 2019.

Which products and versions are affected?

org.webjars:bootstrap (Maven) ECOSYSTEM:introduced=3.0.0,fixed=3.4.1; bootstrap (npm) SEMVER:introduced=4.0.0,fixed=4.3.1; bootstrap-sass (npm) SEMVER:introduced=3.0.0,fixed=3.4.1; bootstrap (NuGet) ECOSYSTEM:introduced=4.0.0,fixed=4.3.1; and 6 more.

Is there a fix for CVE-2019-8331?

Yes. org.webjars:bootstrap (Maven): upgrade to 3.4.1 or later; bootstrap (npm): upgrade to 4.3.1 or later; bootstrap-sass (npm): upgrade to 3.4.1 or later; bootstrap (NuGet): upgrade to 4.3.1 or later; Bootstrap.Less (NuGet): upgrade to 3.4.1 or later; bootstrap.sass (NuGet): upgrade to 4.3.1 or later; twbs/bootstrap (Packagist): upgrade to 3.4.1 or later; bootstrap (RubyGems): upgrade to 4.3.1 or later; bootstrap-sass (RubyGems): upgrade to 3.4.1 or later; twitter-bootstrap-rails (RubyGems): upgrade to 5.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-8331 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-8331?

Check whether you run org.webjars:bootstrap (Maven), bootstrap (npm), bootstrap-sass (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-8331: Bootstrap XSS in tooltip and popover plugins

CVE-2019-8331 · Severity: medium · CVSS 6.1 · Published 2019-02-22

Bootstrap, a popular web development framework, is vulnerable to a security flaw that could allow attackers to execute malicious code in a user's browser. This occurs when the framework's tooltip or popover components are used to display unsanitized content. An exploit could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.

Technologies: org.webjars:bootstrap (Maven), bootstrap (npm), bootstrap-sass (npm), bootstrap (NuGet), bootstrap.sass (NuGet), twbs/bootstrap (Packagist), bootstrap (RubyGems), bootstrap-sass (RubyGems). Vendors: Maven, npm, NuGet, Packagist, RubyGems.

Quick answers

Is CVE-2019-8331 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-8331 being exploited in the wild.
How severe is CVE-2019-8331?: Medium severity, with a CVSS score of 6.1, published 22 February 2019.
Which products and versions are affected?: org.webjars:bootstrap (Maven) ECOSYSTEM:introduced=3.0.0,fixed=3.4.1; bootstrap (npm) SEMVER:introduced=4.0.0,fixed=4.3.1; bootstrap-sass (npm) SEMVER:introduced=3.0.0,fixed=3.4.1; bootstrap (NuGet) ECOSYSTEM:introduced=4.0.0,fixed=4.3.1; and 6 more.
Is there a fix for CVE-2019-8331?: Yes. org.webjars:bootstrap (Maven): upgrade to 3.4.1 or later; bootstrap (npm): upgrade to 4.3.1 or later; bootstrap-sass (npm): upgrade to 3.4.1 or later; bootstrap (NuGet): upgrade to 4.3.1 or later; Bootstrap.Less (NuGet): upgrade to 3.4.1 or later; bootstrap.sass (NuGet): upgrade to 4.3.1 or later; twbs/bootstrap (Packagist): upgrade to 3.4.1 or later; bootstrap (RubyGems): upgrade to 4.3.1 or later; bootstrap-sass (RubyGems): upgrade to 3.4.1 or later; twitter-bootstrap-rails (RubyGems): upgrade to 5.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-8331 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2019-8331?: Check whether you run org.webjars:bootstrap (Maven), bootstrap (npm), bootstrap-sass (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.webjars:bootstrap (Maven): upgrade to 3.4.1 or later

# set org.webjars:bootstrap to 3.4.1 in your pom.xml or build.gradle

bootstrap (npm): upgrade to 4.3.1 or later
```
npm install bootstrap@4.3.1
```
bootstrap-sass (npm): upgrade to 3.4.1 or later
```
npm install bootstrap-sass@3.4.1
```

bootstrap (NuGet): upgrade to 4.3.1 or later

dotnet add package bootstrap --version 4.3.1

Bootstrap.Less (NuGet): upgrade to 3.4.1 or later

dotnet add package Bootstrap.Less --version 3.4.1

bootstrap.sass (NuGet): upgrade to 4.3.1 or later

dotnet add package bootstrap.sass --version 4.3.1

twbs/bootstrap (Packagist): upgrade to 3.4.1 or later
```
composer require twbs/bootstrap:^3.4.1
```
bootstrap (RubyGems): upgrade to 4.3.1 or later
```
bundle update bootstrap
```
bootstrap-sass (RubyGems): upgrade to 3.4.1 or later
```
bundle update bootstrap-sass
```
twitter-bootstrap-rails (RubyGems): upgrade to 5.3.0 or later
```
bundle update twitter-bootstrap-rails
```

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in Bootstrap versions prior to 3.4.1 and 4.3.1. The root cause is the lack of proper input sanitization in the 'data-template' attribute used by the tooltip and popover plugins. A remote attacker can exploit this by injecting malicious JavaScript into this attribute, which is then executed in the context of the victim's browser session when the component is rendered. This is a client-side vulnerability requiring user interaction. Patches are available in versions 3.4.1 and 4.3.1.

Affected products

Bootstrap bootstrap >= 3.0.0, < 3.4.1; >= 4.0.0, < 4.3.1
Bootstrap bootstrap-sass >= 3.0.0, < 3.4.1
Bootstrap twitter-bootstrap-rails < 5.3.0

Identifiers

CVE-2019-8331
GHSA-9v3m-8fp8-mj99

Timeline

2019-02-20: disclosed
2019-02-22: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.