CVE-2019-8331
MEDIUM 6.1EPSS 16.4%
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
- CVSS v3.1 NVD
- 6.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS v2.0 NVD
- 4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N - EPSS
- 16.40% chance of exploitation in the next 30 days, 97th percentile
- Published
- 2019-02-20
- Updated
- 2024-08-04
Proof-of-concept exploits (4)
- Snorlyd/https-nj.gov---CVE-2019-83310★ · 2022-05-23
- Thampakon/CVE-2019-83310★ · 2023-09-11
- Yumeae/Bootstrap-with-XSS4★ · 2025-08-21
- ossf-cve-benchmark/CVE-2019-83310★ · 2020-12-08
Security advisories
- https://blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1
- http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html
- http://seclists.org/fulldisclosure/2019/May/10
- http://seclists.org/fulldisclosure/2019/May/11
- http://seclists.org/fulldisclosure/2019/May/13
- http://www.securityfocus.com/bid/107375
- https://access.redhat.com/errata/RHSA-2019:1456
- https://access.redhat.com/errata/RHSA-2019:3023
- https://access.redhat.com/errata/RHSA-2019:3024
- twbs/bootstrap/pull/28236
- https://seclists.org/bugtraq/2019/May/18
- https://support.f5.com/csp/article/K24383845
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.tenable.com/security/tns-2021-14
- advisories/GHSA-9v3m-8fp8-mj99