bootstrap-4.1.0.min.js: 4 vulnerabilities (highest severity is: 6.1) - autoclosed
mend-for-github-com opened this issue · 1 comments
Vulnerable Library - bootstrap-4.1.0.min.js
The most popular front-end framework for developing responsive, mobile first projects on the web.
Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.0/js/bootstrap.min.js
Path to dependency file: /springboot/src/main/resources/templates/fragments.html
Path to vulnerable library: /springboot/src/main/resources/templates/fragments.html
Found in HEAD commit: a098522a3d94dca5cfac985284941f2c5b8d28ca
Vulnerabilities
| CVE | Severity |  CVSS |
Dependency | Type | Fixed in (bootstrap version) | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2019-8331 |  Medium |
6.1 | bootstrap-4.1.0.min.js | Direct | bootstrap - 3.4.1,4.3.1;bootstrap-sass - 3.4.1,4.3.1 | ❌ |
| CVE-2018-14041 | Medium |
6.1 | bootstrap-4.1.0.min.js | Direct | org.webjars.npm:bootstrap:4.1.2.org.webjars:bootstrap:4.1.2 | ❌ |
| CVE-2018-14040 | Medium |
6.1 | bootstrap-4.1.0.min.js | Direct | org.webjars.npm:bootstrap:4.1.2,org.webjars:bootstrap:3.4.0 | ❌ |
| CVE-2018-14042 | Medium |
6.1 | bootstrap-4.1.0.min.js | Direct | org.webjars.npm:bootstrap:4.1.2.org.webjars:bootstrap:3.4.0 | ❌ |
Details
CVE-2019-8331
Vulnerable Library - bootstrap-4.1.0.min.js
The most popular front-end framework for developing responsive, mobile first projects on the web.
Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.0/js/bootstrap.min.js
Path to dependency file: /springboot/src/main/resources/templates/fragments.html
Path to vulnerable library: /springboot/src/main/resources/templates/fragments.html
Dependency Hierarchy:
- ❌ bootstrap-4.1.0.min.js (Vulnerable Library)
Found in HEAD commit: a098522a3d94dca5cfac985284941f2c5b8d28ca
Found in base branch: main
Vulnerability Details
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
Publish Date: 2019-02-20
URL: CVE-2019-8331
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Release Date: 2019-02-20
Fix Resolution: bootstrap - 3.4.1,4.3.1;bootstrap-sass - 3.4.1,4.3.1
CVE-2018-14041
Vulnerable Library - bootstrap-4.1.0.min.js
The most popular front-end framework for developing responsive, mobile first projects on the web.
Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.0/js/bootstrap.min.js
Path to dependency file: /springboot/src/main/resources/templates/fragments.html
Path to vulnerable library: /springboot/src/main/resources/templates/fragments.html
Dependency Hierarchy:
- ❌ bootstrap-4.1.0.min.js (Vulnerable Library)
Found in HEAD commit: a098522a3d94dca5cfac985284941f2c5b8d28ca
Found in base branch: main
Vulnerability Details
In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.
Publish Date: 2018-07-13
URL: CVE-2018-14041
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Release Date: 2018-07-13
Fix Resolution: org.webjars.npm:bootstrap:4.1.2.org.webjars:bootstrap:4.1.2
CVE-2018-14040
Vulnerable Library - bootstrap-4.1.0.min.js
The most popular front-end framework for developing responsive, mobile first projects on the web.
Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.0/js/bootstrap.min.js
Path to dependency file: /springboot/src/main/resources/templates/fragments.html
Path to vulnerable library: /springboot/src/main/resources/templates/fragments.html
Dependency Hierarchy:
- ❌ bootstrap-4.1.0.min.js (Vulnerable Library)
Found in HEAD commit: a098522a3d94dca5cfac985284941f2c5b8d28ca
Found in base branch: main
Vulnerability Details
In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.
Publish Date: 2018-07-13
URL: CVE-2018-14040
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Release Date: 2018-07-13
Fix Resolution: org.webjars.npm:bootstrap:4.1.2,org.webjars:bootstrap:3.4.0
CVE-2018-14042
Vulnerable Library - bootstrap-4.1.0.min.js
The most popular front-end framework for developing responsive, mobile first projects on the web.
Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.0/js/bootstrap.min.js
Path to dependency file: /springboot/src/main/resources/templates/fragments.html
Path to vulnerable library: /springboot/src/main/resources/templates/fragments.html
Dependency Hierarchy:
- ❌ bootstrap-4.1.0.min.js (Vulnerable Library)
Found in HEAD commit: a098522a3d94dca5cfac985284941f2c5b8d28ca
Found in base branch: main
Vulnerability Details
In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.
Publish Date: 2018-07-13
URL: CVE-2018-14042
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Release Date: 2018-07-13
Fix Resolution: org.webjars.npm:bootstrap:4.1.2.org.webjars:bootstrap:3.4.0
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.