CVE-2024-6484

mediumrejectedpriority · track · 0DEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

— EPSS

CVSS 6.4 · medium

Is it mine?

22 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cert_bund · osv

Rejected reason: This was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.

cvss

Technical severity, 0–10. One row per scoring source.

6.4

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.4mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:Lsecondary · OSV

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79US

affected products (22)

Products and version ranges known to be affected.

Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
IBM DB2 on Cloud Pak for Dataall versionscert_bundDEcpe:/a:ibm:db2:on_cloud_pak_for_data
IBM Power Hardware Management Console V10all versionscert_bundDEcpe:/a:ibm:hardware_management_console:v10
Red Hat Enterprise Linux Discoveryall versionscert_bundDEcpe:/o:redhat:enterprise_linux:discovery
Hitachi Ops Center< 11.0.4-00cert_bundDE
IBM Storage Scale< 5.2.3.4cert_bundDE
IBM Tivoli Network Manager≤ IP Edition <4.2 Fix Pack 23cert_bundDE
Open Source Bootstrap< 5cert_bundDE
Open Source Camunda< 7.20.9cert_bundDE
Open Source Camunda< 7.21.6cert_bundDE
Open Source Camunda< 7.22.1cert_bundDE
Open Source Camunda< 7.23.0-alpha2cert_bundDE
Bootstrap Bootstrap≤ 3.2.0 ≤3.4.1enisa_euvdEU
Maven org.webjars.npm:bootstrap2.0.0 → 3.4.1osvUSpkg:maven/org.webjars.npm/bootstrap
Maven org.webjars:bootstrap2.0.0 → 3.4.1osvUSpkg:maven/org.webjars/bootstrap
NuGet bootstrap2.0.0 → 3.4.1osvUSpkg:nuget/bootstrap
NuGet bootstrap.sass2.0.0 → 3.4.1osvUSpkg:nuget/bootstrap.sass
Packagist twbs/bootstrap2.0.0 → 3.4.1osvUSpkg:composer/twbs/bootstrap
RubyGems bootstrap2.0.0 → 3.4.1osvUSpkg:gem/bootstrap
RubyGems bootstrap-sass2.0.0 → 3.4.1osvUSpkg:gem/bootstrap-sass

showing 20 of 22

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-1606Bootstrap: Mehrere Schwachstellen ermöglichen Cross-Site ScriptingDeutsch2024-07-11csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Bootstrap ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.
GHSA-9mvj-f7w8-pvh2Withdrawn Advisory: Bootstrap Cross-Site Scripting (XSS) vulnerability2024-07-11ghsa · osvUS
## Withdrawn Advisory This advisory has been withdrawn because it was determined to not be a vulnerability in Bootstrap. From the CVE: > This was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded. ## Original Description A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the `data-slide` and `data-slide-to` attributes can be exploited through the href attribute of an `<a>` tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund osv NVD CVE.org MITRE

published 2024-07-11modified 2025-08-01

references (3) cnnvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan