CVE-2018-14042: XSS
A flaw was found in Bootstrap from version 4.0 and before 4.1.2. A Cross-site Scripting (XSS) is possible in the data-container property of tooltip.
References: https://github.com/twbs/bootstrap/issues/26628
Upstream Patch: https://github.com/twbs/bootstrap/pull/26630
Other sources
Bootstrap is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the data-container property of tooltip. A remote attacker could exploit this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.
In Bootstrap starting in version 2.3.0 and prior to versions 3.4.0 and 4.1.2, XSS is possible in the data-container property of tooltip. This is similar to CVE-2018-14041.
— GitHub
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this Bootstrap vulnerability?
The vulnerability ID for this Bootstrap vulnerability is CVE-2018-14042.
What is the severity of CVE-2018-14042?
The severity of CVE-2018-14042 is medium.
Which version of Bootstrap is affected by CVE-2018-14042?
Versions up to and excluding 4.1.2 of Bootstrap are affected by CVE-2018-14042.
How can I fix CVE-2018-14042?
To fix CVE-2018-14042, update Bootstrap to version 4.1.2 or later.
What is the Common Weakness Enumeration ID for CVE-2018-14042?
The Common Weakness Enumeration (CWE) ID for CVE-2018-14042 is CWE-79.