Is CVE-2024-6485 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-6485 being exploited in the wild.

How severe is CVE-2024-6485?

Low severity, with a CVSS score of 3.1, published 11 July 2024.

Which products and versions are affected?

bootstrap (npm) SEMVER:introduced=1.4.0,last_affected=3.4.1.

Is there a fix for CVE-2024-6485?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2024-6485 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-6485?

Check whether you run bootstrap (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-6485: Bootstrap Cross-Site Scripting in data-* attributes

CVE-2024-6485 · Severity: low · CVSS 3.1 · Published 2024-07-11

Bootstrap is a widely-used open-source framework for building responsive web interfaces. This vulnerability allows attackers to inject malicious JavaScript code through data-* attributes (particularly data-loading-text on buttons), which executes when users interact with affected components. An attacker could exploit this to steal session cookies, redirect users to malicious sites, or deface web pages.

Technologies: bootstrap (npm). Vendors: npm.

Quick answers

Is CVE-2024-6485 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-6485 being exploited in the wild.
How severe is CVE-2024-6485?: Low severity, with a CVSS score of 3.1, published 11 July 2024.
Which products and versions are affected?: bootstrap (npm) SEMVER:introduced=1.4.0,last_affected=3.4.1.
Is there a fix for CVE-2024-6485?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-6485 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-6485?: Check whether you run bootstrap (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a Stored/Reflected Cross-Site Scripting (XSS) vulnerability (CWE-79) in Bootstrap's button plugin, where the data-loading-text attribute is not properly sanitized. Malicious JavaScript injected into the data-loading-text attribute executes when the button's loading state is triggered. The vulnerability affects Bootstrap versions 1.4.0 through 3.4.1. Attack requires user interaction (clicking the button) but no authentication. An attacker can craft a web page or modify an existing page to include a button with malicious data-loading-text, and any user who triggers the loading state will execute the injected code.

Affected products

Bootstrap Bootstrap 1.4.0 through 3.4.1

Identifiers

CVE-2024-6485
GHSA-vxmc-5x29-h64v

Timeline

2024-07-11: disclosed
2024-07-11: advisory: OSV and NVD publication

References

https://github.com/twbs/bootstrap

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.