CVE-2018-14040: XSS
A flaw was found in Bootstrap from version 4.0 and before 4.1.2. A Cross-site Scripting (XSS) is possible in the collapse data-parent attribute.
References: https://github.com/twbs/bootstrap/issues/26625
Upstream Patch: https://github.com/twbs/bootstrap/pull/26630
Other sources
Bootstrap is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the collapse data-parent attribute. A remote attacker could exploit this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.
In Bootstrap starting in version 2.3.0 and prior to 3.4.0, as well as 4.x before 4.1.2, XSS is possible in the collapse data-parent attribute.
— GitHub
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2018-14040?
The severity of CVE-2018-14040 is medium.
How does CVE-2018-14040 affect Bootstrap?
CVE-2018-14040 affects Bootstrap by allowing cross-site scripting (XSS) attacks through the collapse data-parent attribute.
Is there a known remedy for CVE-2018-14040?
Yes, the known remedy for CVE-2018-14040 is to update Bootstrap to version 4.1.2.
What is the Common Weakness Enumeration (CWE) identifier for CVE-2018-14040?
The Common Weakness Enumeration (CWE) identifier for CVE-2018-14040 is CWE-79.
Where can I find more information about CVE-2018-14040?
More information about CVE-2018-14040 can be found at the following references: [link1], [link2], [link3].