CVE-2019-8331 Bootstrap Vulnerable to Cross-Site Scripting
Cross-site scripting vulnerability in Bootstrap allows attackers to execute arbitrary scripts via malicious tooltip or popover data-template attributes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-8331?
CVE-2019-8331 is a medium-severity cross-site scripting vulnerability in F5 Big-Ip Access Policy Manager, published on 20 Feb 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
Weakness: CWE-79
Which versions are affected by CVE-2019-8331?
28 open source packages ship an affected version, including bootstrap, org.webjars:bootstrap and Bootstrap.Less. It affects 16 products.
| Package | Affected | Fixed in |
|---|---|---|
bootstrap NuGet | From 3.0.0 | 3.4.1 |
bootstrap NuGet | From 3.0.0 | 3.4.1 |
bootstrap NuGet | From 4.0.0 | 4.3.1 |
bootstrap NuGet | From 4.0.0 | 4.3.1 |
bootstrap RubyGems | All versions | 4.3.1 |
bootstrap RubyGems | All versions | 4.3.1 |
22 more packages
bootstrap npm | From 3.0.0 | 3.4.1 |
bootstrap npm | From 3.0.0 | 3.4.1 |
bootstrap npm | From 4.0.0 | 4.3.1 |
bootstrap npm | From 4.0.0 | 4.3.1 |
org.webjars:bootstrap Maven | From 3.0.0 | 3.4.1 |
org.webjars:bootstrap Maven | From 3.0.0 | 3.4.1 |
org.webjars:bootstrap Maven | From 4.0.0 | 4.3.1 |
org.webjars:bootstrap Maven | From 4.0.0 | 4.3.1 |
Bootstrap.Less NuGet | From 3.0.0 | 3.4.1 |
Bootstrap.Less NuGet | From 3.0.0 | 3.4.1 |
bootstrap.sass NuGet | All versions | 4.3.1 |
bootstrap.sass NuGet | All versions | 4.3.1 |
twbs/bootstrap Packagist | From 3.0.0 | 3.4.1 |
twbs/bootstrap Packagist | From 3.0.0 | 3.4.1 |
twbs/bootstrap Packagist | From 4.0.0 | 4.3.1 |
twbs/bootstrap Packagist | From 4.0.0 | 4.3.1 |
bootstrap-sass RubyGems | From 3.0.0 | 3.4.1 |
bootstrap-sass RubyGems | From 3.0.0 | 3.4.1 |
twitter-bootstrap-rails RubyGems | All versions | 5.3.0 |
twitter-bootstrap-rails RubyGems | All versions | 5.3.0 |
bootstrap-sass npm | From 3.0.0 | 3.4.1 |
bootstrap-sass npm | From 3.0.0 | 3.4.1 |
Linux distribution packages (4)
python-XStatic-Bootstrap-SCSS Red Hat:openstack:16.1::el8 | All versions | 0:3.4.1.0-2.el8ost |
python-XStatic-Bootstrap-SCSS Red Hat:openstack:16.2::el8 | All versions | 0:3.4.1.0-2.el8ost |
python3-XStatic-Bootstrap-SCSS Red Hat:openstack:16.2::el8 | All versions | 0:3.4.1.0-2.el8ost |
xstatic-bootstrap-scss-common Red Hat:openstack:16.2::el8 | All versions | 0:3.4.1.0-2.el8ost |
Products include F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Analytics, F5 Big-Ip Application Acceleration Manager, F5 Big-Ip Application Security Manager, F5 Big-Ip Domain Name System and 10 more.
How do I fix CVE-2019-8331?
Upgrade bootstrap to a fixed version for your release line: 3.4.1 or 4.3.1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2019-8331 being exploited?
There is no known exploitation of CVE-2019-8331 in the wild and no public exploit code.
Public exploit code: 3 proofs of concept on GitHub.
Other vulnerabilities in F5 Big-Ip Access Policy Manager
- CVE-2023-46747 F5 BIG-IP Configuration Utility Authentication Bypass
- CVE-2022-1388 F5 BIG-IP Missing Authentication
- CVE-2021-22986 F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution
- CVE-2021-22991 F5 BIG-IP Traffic Management Microkernel Buffer Overflow
- CVE-2020-5902 F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution
Sources
Also known as AZL-105101, AZL-105137, AZL-105155, AZL-105203, AZL-105266, CLSA-2026-1774743842 and 7 more.