CVE-2024-6485

mediumpriority · track · 10EPSS 0.005 · 42 %ileexploit · PoCDEEUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

0.49% (42nd) EPSS

CVSS 6.4 · medium

Is it mine?

15 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cert_bund · osv

EPSS · scored 2026-10-23

A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.

cvss

Technical severity, 0–10. One row per scoring source.

6.4

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.4mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:Lsecondary · ENISA EU

v3.16.4mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:Lsecondaryexploitability 1.6 · impact 4.7

v3.16.4mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:Lsecondary · OSV

v3.16.1mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L/E:Psecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: no · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79USCWE-79US

exploits (1)

Public proof-of-concept and weaponised exploit code.

Yumeae/Bootstrap-with-XSSA poc for Bootstrap XSS(CVE-2024-6485、CVE-2016-10735、CVE-2019-8331、CVE-2018-14040)PoC · poc_in_github

affected products (15)

Products and version ranges known to be affected.

Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
IBM DB2 on Cloud Pak for Dataall versionscert_bundDEcpe:/a:ibm:db2:on_cloud_pak_for_data
IBM Power Hardware Management Console V10all versionscert_bundDEcpe:/a:ibm:hardware_management_console:v10
Red Hat Enterprise Linux Discoveryall versionscert_bundDEcpe:/o:redhat:enterprise_linux:discovery
Hitachi Ops Center< 11.0.4-00cert_bundDE
IBM Storage Scale< 5.2.3.4cert_bundDE
IBM Tivoli Network Manager≤ IP Edition <4.2 Fix Pack 23cert_bundDE
Open Source Bootstrap< 5cert_bundDE
Open Source Camunda< 7.20.9cert_bundDE
Open Source Camunda< 7.21.6cert_bundDE
Open Source Camunda< 7.22.1cert_bundDE
Open Source Camunda< 7.23.0-alpha2cert_bundDE
Bootstrap≤ 1.4.0 ≤3.4.1enisa_euvdEU
bootstrap-sass≤ 2.3.2 ≤3.4.3enisa_euvdEU
npm bootstrap1.4.0 → 3.4.1osvUSpkg:npm/bootstrap

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-1606Bootstrap: Mehrere Schwachstellen ermöglichen Cross-Site ScriptingDeutsch2024-07-11csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Bootstrap ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.
GHSA-vxmc-5x29-h64vBootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes2024-07-11ghsa · osvUS
A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund osv NVD CVE.org MITRE

published 2024-07-11modified 2026-06-17

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan