CVE-2024-6485: XSS in Bootstrap button component
A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/bootstrapto a version that resolves this vulnerability.Fixed in 3.4.1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6485?
CVE-2024-6485 is classified as a moderate severity vulnerability due to its potential to enable Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2024-6485?
To fix CVE-2024-6485, update the bootstrap package to version 3.4.1 or later.
Which versions of bootstrap are affected by CVE-2024-6485?
Affected versions include all bootstrap releases from 1.4.0 to before 3.4.1.
What are the potential impacts of CVE-2024-6485?
CVE-2024-6485 can lead to unauthorized execution of malicious scripts and data theft through XSS attacks.
Is the data-loading-text attribute related to CVE-2024-6485?
Yes, the vulnerability in CVE-2024-6485 is specifically associated with the data-loading-text attribute in the bootstrap button plugin.