RubySecRUBY:BOOTSTRAP-2024-6531Bootstrap Cross-Site Scripting (XSS) vulnerability
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
AI Score
Confidence
High
A vulnerability has been identified in Bootstrap that exposes users
to Cross-Site Scripting (XSS) attacks. The issue is present in the
carousel component, where the data-slide and data-slide-to attributes
can be exploited through the href attribute of an <a> tag due to
inadequate sanitization. This vulnerability could potentially enable
attackers to execute arbitrary JavaScript within the victim’s browser.
Affected configurations
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
AI Score
Confidence
High