CVE-2024-6484

mediumrejectedPriorität · verfolgen · 0DEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

— EPSS

CVSS 6.4 · medium

Is it mine?

22 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · cert_bund · osv

Rejected reason: This was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.4

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.16.4mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:Lsecondary · OSV

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-79US

betroffene Produkte (22)

Betroffene Produkte und Versionsbereiche.

Debian Linuxalle Versionencert_bundDEcpe:/o:debian:debian_linux:-
IBM DB2 on Cloud Pak for Dataalle Versionencert_bundDEcpe:/a:ibm:db2:on_cloud_pak_for_data
IBM Power Hardware Management Console V10alle Versionencert_bundDEcpe:/a:ibm:hardware_management_console:v10
Red Hat Enterprise Linux Discoveryalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:discovery
Hitachi Ops Center< 11.0.4-00cert_bundDE
IBM Storage Scale< 5.2.3.4cert_bundDE
IBM Tivoli Network Manager≤ IP Edition <4.2 Fix Pack 23cert_bundDE
Open Source Bootstrap< 5cert_bundDE
Open Source Camunda< 7.20.9cert_bundDE
Open Source Camunda< 7.21.6cert_bundDE
Open Source Camunda< 7.22.1cert_bundDE
Open Source Camunda< 7.23.0-alpha2cert_bundDE
Bootstrap Bootstrap≤ 3.2.0 ≤3.4.1enisa_euvdEU
Maven org.webjars.npm:bootstrap2.0.0 → 3.4.1osvUSpkg:maven/org.webjars.npm/bootstrap
Maven org.webjars:bootstrap2.0.0 → 3.4.1osvUSpkg:maven/org.webjars/bootstrap
NuGet bootstrap2.0.0 → 3.4.1osvUSpkg:nuget/bootstrap
NuGet bootstrap.sass2.0.0 → 3.4.1osvUSpkg:nuget/bootstrap.sass
Packagist twbs/bootstrap2.0.0 → 3.4.1osvUSpkg:composer/twbs/bootstrap
RubyGems bootstrap2.0.0 → 3.4.1osvUSpkg:gem/bootstrap
RubyGems bootstrap-sass2.0.0 → 3.4.1osvUSpkg:gem/bootstrap-sass

20 von 22 angezeigt

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

WID-SEC-W-2024-1606Bootstrap: Mehrere Schwachstellen ermöglichen Cross-Site ScriptingDeutsch2024-07-11csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Bootstrap ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.
GHSA-9mvj-f7w8-pvh2Withdrawn Advisory: Bootstrap Cross-Site Scripting (XSS) vulnerability2024-07-11ghsa · osvUS
## Withdrawn Advisory This advisory has been withdrawn because it was determined to not be a vulnerability in Bootstrap. From the CVE: > This was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded. ## Original Description A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the `data-slide` and `data-slide-to` attributes can be exploited through the href attribute of an `<a>` tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cert_bund osv NVD CVE.org MITRE

veröffentlicht 2024-07-11geändert 2025-08-01

Referenzen (3) cnnvd

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan