CVE-2024-6484: XSS in Bootstrap carousel component
A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an <a> tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.
Other sources
A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an <a> tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.
— NVD
Rejected reason: This was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6484?
CVE-2024-6484 is a Cross-Site Scripting (XSS) vulnerability categorized as high severity.
How do I fix CVE-2024-6484?
To fix CVE-2024-6484, update Bootstrap to a version newer than 3.4.1.
Which versions of Bootstrap are affected by CVE-2024-6484?
Bootstrap versions between 2.0.0 and 3.4.1 are affected by CVE-2024-6484.
What component of Bootstrap does CVE-2024-6484 affect?
CVE-2024-6484 affects the carousel component of Bootstrap.
What type of attack can be executed due to CVE-2024-6484?
CVE-2024-6484 can be exploited to execute Cross-Site Scripting (XSS) attacks.