CVE-2019-8331

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 20-02-2019 05:29

Last modified: - 16-05-2022 09:52

Total changes: - 4

Description

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Low

Attack complexity

Network

Attack vector

None

Availability

Low

Confidentiality

Low

Integrity

None

Privileges required

Changed

Scope

Required

User interaction

6.1

Base score

2.8

2.7

Exploitability score

Impact score

Verification logic

vendor=getbootstrap AND product=bootstrap AND versionEndExcluding=3.4.1

vendor=getbootstrap AND product=bootstrap AND versionStartIncluding=4.3.0 AND versionEndExcluding=4.3.1

vendor=f5 AND product=big-ip_local_traffic_manager AND versionStartIncluding=15.0.0 AND versionEndExcluding=15.1.0

vendor=f5 AND product=big-ip_application_security_manager AND versionStartIncluding=15.0.0 AND versionEndExcluding=15.1.0

vendor=f5 AND product=big-ip_access_policy_manager AND versionStartIncluding=15.0.0 AND versionEndExcluding=15.1.0

vendor=f5 AND product=big-ip_advanced_firewall_manager AND versionStartIncluding=15.0.0 AND versionEndExcluding=15.1.0

vendor=f5 AND product=big-ip_analytics AND versionStartIncluding=15.0.0 AND versionEndExcluding=15.1.0

vendor=f5 AND product=big-ip_application_acceleration_manager AND versionStartIncluding=15.0.0 AND versionEndExcluding=15.1.0

vendor=f5 AND product=big-ip_domain_name_system AND versionStartIncluding=15.0.0 AND versionEndExcluding=15.1.0

vendor=f5 AND product=big-ip_fraud_protection_service AND versionStartIncluding=15.0.0 AND versionEndExcluding=15.1.0

vendor=f5 AND product=big-ip_global_traffic_manager AND versionStartIncluding=15.0.0 AND versionEndExcluding=15.1.0

vendor=f5 AND product=big-ip_link_controller AND versionStartIncluding=15.0.0 AND versionEndExcluding=15.1.0

vendor=f5 AND product=big-ip_access_policy_manager AND versionStartIncluding=12.1.0 AND versionEndExcluding=12.1.5.1

vendor=f5 AND product=big-ip_advanced_firewall_manager AND versionStartIncluding=12.1.0 AND versionEndExcluding=12.1.5.1

vendor=f5 AND product=big-ip_advanced_firewall_manager AND versionStartIncluding=14.0.0 AND versionEndExcluding=14.1.2.5

vendor=f5 AND product=big-ip_analytics AND versionStartIncluding=12.1.0 AND versionEndExcluding=12.1.5.1

vendor=f5 AND product=big-ip_analytics AND versionStartIncluding=14.0.0 AND versionEndExcluding=14.1.2.5

vendor=f5 AND product=big-ip_application_acceleration_manager AND versionStartIncluding=12.1.0 AND versionEndExcluding=12.1.5.1

vendor=f5 AND product=big-ip_application_acceleration_manager AND versionStartIncluding=14.0.0 AND versionEndExcluding=14.1.2.5

vendor=f5 AND product=big-ip_application_security_manager AND versionStartIncluding=12.1.0 AND versionEndExcluding=12.1.5.1

vendor=f5 AND product=big-ip_domain_name_system AND versionStartIncluding=12.1.0 AND versionEndExcluding=12.1.5.1

vendor=f5 AND product=big-ip_edge_gateway AND versionStartIncluding=12.1.0 AND versionEndExcluding=12.1.5.1

vendor=f5 AND product=big-ip_edge_gateway AND versionStartIncluding=15.0.0 AND versionEndExcluding=15.1.0

vendor=f5 AND product=big-ip_fraud_protection_service AND versionStartIncluding=12.1.0 AND versionEndExcluding=12.1.5.1

vendor=f5 AND product=big-ip_global_traffic_manager AND versionStartIncluding=12.1.0 AND versionEndExcluding=12.1.5.1

vendor=f5 AND product=big-ip_link_controller AND versionStartIncluding=12.1.0 AND versionEndExcluding=12.1.5.1

vendor=f5 AND product=big-ip_local_traffic_manager AND versionStartIncluding=12.1.0 AND versionEndExcluding=12.1.5.1

vendor=f5 AND product=big-ip_local_traffic_manager AND versionStartIncluding=14.0.0 AND versionEndExcluding=14.1.2.5

vendor=f5 AND product=big-ip_policy_enforcement_manager AND versionStartIncluding=12.1.0 AND versionEndExcluding=12.1.5.1

vendor=f5 AND product=big-ip_policy_enforcement_manager AND versionStartIncluding=15.0.0 AND versionEndExcluding=15.1.0

vendor=f5 AND product=big-ip_webaccelerator AND versionStartIncluding=12.1.0 AND versionEndExcluding=12.1.5.1

vendor=f5 AND product=big-ip_webaccelerator AND versionStartIncluding=15.0.0 AND versionEndExcluding=15.1.0

vendor=f5 AND product=big-ip_access_policy_manager AND versionStartIncluding=13.0.0 AND versionEndExcluding=13.1.3.4

vendor=f5 AND product=big-ip_access_policy_manager AND versionStartIncluding=14.0.0 AND versionEndExcluding=14.1.2.5

vendor=f5 AND product=big-ip_advanced_firewall_manager AND versionStartIncluding=13.0.0 AND versionEndExcluding=13.1.3.4

vendor=f5 AND product=big-ip_analytics AND versionStartIncluding=13.0.0 AND versionEndExcluding=13.1.3.4

vendor=f5 AND product=big-ip_application_acceleration_manager AND versionStartIncluding=13.0.0 AND versionEndExcluding=13.1.3.4

vendor=f5 AND product=big-ip_application_security_manager AND versionStartIncluding=13.0.0 AND versionEndExcluding=13.1.3.4

vendor=f5 AND product=big-ip_application_security_manager AND versionStartIncluding=14.0.0 AND versionEndExcluding=14.1.2.5

vendor=f5 AND product=big-ip_domain_name_system AND versionStartIncluding=13.0.0 AND versionEndExcluding=13.1.3.4

vendor=f5 AND product=big-ip_domain_name_system AND versionStartIncluding=14.0.0 AND versionEndExcluding=14.1.2.5

vendor=f5 AND product=big-ip_edge_gateway AND versionStartIncluding=13.0.0 AND versionEndExcluding=13.1.3.4

vendor=f5 AND product=big-ip_edge_gateway AND versionStartIncluding=14.0.0 AND versionEndExcluding=14.1.2.5

vendor=f5 AND product=big-ip_fraud_protection_service AND versionStartIncluding=13.0.0 AND versionEndExcluding=13.1.3.4

vendor=f5 AND product=big-ip_fraud_protection_service AND versionStartIncluding=14.0.0 AND versionEndExcluding=14.1.2.5

vendor=f5 AND product=big-ip_global_traffic_manager AND versionStartIncluding=13.0.0 AND versionEndExcluding=13.1.3.4

vendor=f5 AND product=big-ip_global_traffic_manager AND versionStartIncluding=14.0.0 AND versionEndExcluding=14.1.2.5

vendor=f5 AND product=big-ip_link_controller AND versionStartIncluding=13.0.0 AND versionEndExcluding=13.1.3.4

vendor=f5 AND product=big-ip_link_controller AND versionStartIncluding=14.0.0 AND versionEndExcluding=14.1.2.5

vendor=f5 AND product=big-ip_local_traffic_manager AND versionStartIncluding=13.0.0 AND versionEndExcluding=13.1.3.4

vendor=f5 AND product=big-ip_policy_enforcement_manager AND versionStartIncluding=13.0.0 AND versionEndExcluding=13.1.3.4

vendor=f5 AND product=big-ip_policy_enforcement_manager AND versionStartIncluding=14.0.0 AND versionEndExcluding=14.1.2.5

vendor=f5 AND product=big-ip_webaccelerator AND versionStartIncluding=13.0.0 AND versionEndExcluding=13.1.3.4

vendor=f5 AND product=big-ip_webaccelerator AND versionStartIncluding=14.0.0 AND versionEndExcluding=14.1.2.5

vendor=Red Hat Enterprise Linux AND product=virtualization_manager AND version=4.3

vendor=tenable AND product=tenable.sc AND versionEndExcluding=5.19.0

Reference

https://github.com/twbs/bootstrap/releases/tag/v4.3.1
https://github.com/twbs/bootstrap/pull/28236
107375-Third Party Advisory, VDB Entry
https://github.com/twbs/bootstrap/releases/tag/v3.4.1
https://blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1/
https://support.f5.com/csp/article/K24383845
20190509 dotCMS v5.1.1 Vulnerabilities-Mailing List, Third Party Advisory
20190510 Re: dotCMS v5.1.1 HTML Injection & XSS Vulnerability-Mailing List, Third Party Advisory
20190510 dotCMS v5.1.1 HTML Injection & XSS Vulnerability-Mailing List, Third Party Advisory
20190510 dotCMS v5.1.1 Vulnerabilities-Mailing List, Third Party Advisory
RHSA-2019:1456-Third Party Advisory
[flink-user] 20190811 Apache flink 1.7.2 security issues-Exploit, Mailing List, Third Party Advisory
[flink-dev] 20190811 Apache flink 1.7.2 security issues-Exploit, Mailing List, Third Party Advisory
[flink-user] 20190813 Apache flink 1.7.2 security issues-Exploit, Mailing List, Third Party Advisory
[flink-user] 20190813 Re: Apache flink 1.7.2 security issues-Mailing List, Third Party Advisory
[superset-dev] 20190926 Re: [VOTE] Release Superset 0.34.1 based on Superset 0.34.1rc1-Mailing List, Third Party Advisory
RHSA-2019:3023-Third Party Advisory
RHSA-2019:3024-Third Party Advisory
[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities-Mailing List, Third Party Advisory
[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities-Mailing List, Third Party Advisory
[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities-Mailing List, Third Party Advisory
https://support.f5.com/csp/article/K24383845?utm_source=f5support&amp;utm_medium=RSS
http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html
[hbase-issues] 20201116 [GitHub] [hbase] symat opened a new pull request #2661: HBASE-25261 Upgrade Bootstrap to 3.4.1-Mailing List, Third Party Advisory
[pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list-Mailing List, Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.tenable.com/security/tns-2021-14

Keywords

CVE-2019-8331

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2019-8331

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures