CVE-2016-10735: XSS

Published Jun 27, 2016
·
Updated

Bootstrap is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the data-target attribute. A remote attacker could exploit this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

Other sources

In Bootstrap 2.x from 2.0.4, 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute. Note that this is a different vulnerability than CVE-2018-14041.

See https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/ for more info.

— GitHub

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

Affected Software

76 affected componentsFixes available
redhat/ansible-runner<0:1.3.4-2.el8a
0:1.3.4-2.el8a
redhat/ansible-tower<0:3.5.2-1.el8a
0:3.5.2-1.el8a
redhat/cfme<0:5.11.0.28-1.el8cf
0:5.11.0.28-1.el8cf
redhat/cfme-amazon-smartstate<0:5.11.0.28-1.el8cf
0:5.11.0.28-1.el8cf
redhat/cfme-appliance<0:5.11.0.28-1.el8cf
0:5.11.0.28-1.el8cf
redhat/cfme-gemset<0:5.11.0.28-1.el8cf
0:5.11.0.28-1.el8cf
redhat/ovirt-ansible-cluster-upgrade<0:1.1.13-1.el8e
0:1.1.13-1.el8e
redhat/ovirt-ansible-disaster-recovery<0:1.2.0-1.el8e
0:1.2.0-1.el8e
redhat/ovirt-ansible-engine-setup<0:1.1.9-1.el8e
0:1.1.9-1.el8e
redhat/ovirt-ansible-hosted-engine-setup<0:1.0.26-1.el8e
0:1.0.26-1.el8e
redhat/ovirt-ansible-image-template<0:1.1.11-1.el8e
0:1.1.11-1.el8e
redhat/ovirt-ansible-infra<0:1.1.12-1.el8e
0:1.1.12-1.el8e
redhat/ovirt-ansible-manageiq<0:1.1.14-1.el8e
0:1.1.14-1.el8e
redhat/ovirt-ansible-repositories<0:1.1.5-1.el8e
0:1.1.5-1.el8e
redhat/ovirt-ansible-roles<0:1.1.7-2.el8e
0:1.1.7-2.el8e
redhat/ovirt-ansible-shutdown-env<0:1.0.3-1.el8e
0:1.0.3-1.el8e
redhat/ovirt-ansible-vm-infra<0:1.1.19-1.el8e
0:1.1.19-1.el8e
redhat/prince<0:12.4-1.el8cf
0:12.4-1.el8cf
redhat/python3-ovirt-engine-sdk4<0:4.3.2-1.el8e
0:4.3.2-1.el8e
redhat/python-bambou<0:3.0.1-2.el8cf
0:3.0.1-2.el8cf
redhat/python-colorama<0:0.4.1-1.el8
0:0.4.1-1.el8
redhat/python-daemon<0:2.1.2-9.el8a
0:2.1.2-9.el8a
redhat/python-funcsigs<0:1.0.2-3.el8
0:1.0.2-3.el8
redhat/python-future<0:0.16.0-1.el8cf
0:0.16.0-1.el8cf
redhat/python-lockfile<1:0.11.0-8.el8a
1:0.11.0-8.el8a
redhat/python-mock<0:2.0.0-11.el8
0:2.0.0-11.el8
redhat/python-pbr<0:5.1.2-2.el8
0:5.1.2-2.el8
redhat/python-pexpect<0:4.6-2.el8a
0:4.6-2.el8a
redhat/python-psutil<0:5.4.3-5.el8a
0:5.4.3-5.el8a
redhat/python-pylxca<0:2.1.1-2.el8cf
0:2.1.1-2.el8cf
redhat/python-requests-toolbelt<0:0.8.0-2.el8cf
0:0.8.0-2.el8cf
redhat/python-tabulate<0:0.8.2-1.el8cf
0:0.8.2-1.el8cf
redhat/python-vspk<0:5.3.2-2.el8cf
0:5.3.2-2.el8cf
redhat/qpid-proton<0:0.28.0-1.el8
0:0.28.0-1.el8
redhat/repmgr10<0:4.0.6-3.el8cf
0:4.0.6-3.el8cf
redhat/rubygem-bcrypt<0:3.1.13-1.el8cf
0:3.1.13-1.el8cf
redhat/rubygem-byebug<0:11.0.1-1.el8cf
0:11.0.1-1.el8cf
redhat/rubygem-ffi<0:1.9.25-1.el8cf
0:1.9.25-1.el8cf
redhat/rubygem-hamlit<0:2.8.10-1.el8cf
0:2.8.10-1.el8cf
redhat/rubygem-nio4r<0:2.4.0-1.el8cf
0:2.4.0-1.el8cf
redhat/rubygem-nokogiri<0:1.8.5-1.el8cf
0:1.8.5-1.el8cf
redhat/rubygem-ovirt-engine-sdk4<0:4.3.0-1.el8cf
0:4.3.0-1.el8cf
redhat/rubygem-puma<0:3.7.1-1.el8cf
0:3.7.1-1.el8cf
redhat/rubygem-rugged<0:0.28.2-1.el8cf
0:0.28.2-1.el8cf
redhat/rubygem-sassc<0:2.0.1-1.el8cf
0:2.0.1-1.el8cf
redhat/rubygem-sqlite3<0:1.3.13-2.el8cf
0:1.3.13-2.el8cf
redhat/rubygem-surro-gate<0:1.0.5-1.el8cf
0:1.0.5-1.el8cf
redhat/rubygem-websocket-driver<0:0.6.5-1.el8cf
0:0.6.5-1.el8cf
redhat/smem<0:1.4-1.el8cf
0:1.4-1.el8cf
redhat/v2v-conversion-host<0:1.14.2-1.el8e
0:1.14.2-1.el8e
redhat/wmi<0:1.3.14-8.el8cf
0:1.3.14-8.el8cf
redhat/ipa<0:4.6.8-5.el7
0:4.6.8-5.el7
redhat/eap7-hal-console<0:3.3.16-1.Final_redhat_00001.1.el8ea
0:3.3.16-1.Final_redhat_00001.1.el8ea
redhat/eap7-hal-console<0:3.3.16-1.Final_redhat_00001.1.el9ea
0:3.3.16-1.Final_redhat_00001.1.el9ea
redhat/eap7-hal-console<0:3.3.16-1.Final_redhat_00001.1.el7ea
0:3.3.16-1.Final_redhat_00001.1.el7ea
redhat/ovirt-engine-api-explorer<0:0.0.4-1.el7e
0:0.0.4-1.el7e
redhat/ovirt-engine-api-explorer<0:0.0.5-1.el7e
0:0.0.5-1.el7e
redhat/ovirt-engine-ui-extensions<0:1.0.10-1.el7e
0:1.0.10-1.el7e
redhat/bootstrap<3.4.0
3.4.0
redhat/bootstrap<4.0.0
4.0.0
nuget/bootstrap.sass>=4.0.0-beta<4.0.0-beta.2
4.0.0-beta.2
rubygems/bootstrap-sass>=2.0.4<3.4.0
3.4.0
npm/bootstrap-sass>=2.0.4<3.4.0
3.4.0
nuget/bootstrap>=4.0.0-beta<4.0.0-beta.2
4.0.0-beta.2
nuget/bootstrap>=2.0.4<3.4.0
3.4.0
composer/twbs/bootstrap>=4.0.0-beta<4.0.0-beta.2
4.0.0-beta.2
composer/twbs/bootstrap>=2.0.4<3.4.0
3.4.0
rubygems/bootstrap<4.0.0-beta.2
4.0.0-beta.2
maven/org.webjars:bootstrap>=4.0.0-beta<4.0.0-beta.2
4.0.0-beta.2
maven/org.webjars:bootstrap>=2.0.4<3.4.0
3.4.0
npm/bootstrap>=2.0.4<3.4.0
3.4.0
npm/bootstrap>=4.0.0-beta<4.0.0-beta.2
4.0.0-beta.2
IBM Cognos Analytics<=12.0.0-12.0.3
IBM Cognos Analytics<=11.2.0-11.2.4 FP4
getbootstrap Bootstrap>=3.0.0<3.4.0
getbootstrap Bootstrap=4.0.0-beta

Remediation

Patch Available

https://github.com/twbs/bootstrap/pull/23687

Event History

Jun 27, 2016
CVE Published
12:00 AM
Jan 9, 2019
CVE Published
via MITRE·05:00 AM
Data Sourced
via MITRE·05:00 AM
Description
Jan 17, 2019
Advisory Published
via GitHub·01:57 PM
Jan 21, 2019
Data Sourced
via Red Hat·09:42 PM
DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2016-10735?

CVE-2016-10735 is classified as a medium severity vulnerability due to the potential for cross-site scripting attacks.

2

How do I fix CVE-2016-10735?

To fix CVE-2016-10735, update your Bootstrap version to 4.0.0 or later.

3

Which versions of Bootstrap are affected by CVE-2016-10735?

Bootstrap versions prior to 4.0.0 are affected by CVE-2016-10735.

4

What type of vulnerability is CVE-2016-10735?

CVE-2016-10735 is a cross-site scripting vulnerability that allows remote code execution in a victim's browser.

5

Who is impacted by CVE-2016-10735?

Web applications utilizing vulnerable versions of Bootstrap are potentially impacted by CVE-2016-10735.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203