Skip to content
Fencer Vulns
medium 6.1

CVE-2016-10735 json

Bootstrap Cross-site Scripting vulnerability

published 2019-01-09 7 y ago modified 2026-09-10 1 mo ago also GHSA-4p24-vmcr-4gqj , EUVD-2019-0174

cvss
6.1
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
4.0%
EPSS 4.0% chance of exploitation in 30 days, percentile 90%
public exploits
0
none known

Summary

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

Patch / fix

  • npm bootstrap 3.4.0, 4.0.0-beta.2
  • maven org.webjars:bootstrap 3.4.0, 4.0.0-beta.2
  • rubygems bootstrap 4.0.0-beta.2
  • packagist twbs/bootstrap 3.4.0, 4.0.0-beta.2
  • nuget bootstrap 3.4.0, 4.0.0-beta.2
  • npm bootstrap-sass 3.4.0
  • rubygems bootstrap-sass 3.4.0
  • nuget bootstrap.sass 4.0.0-beta.2
  • getbootstrap bootstrap 3.4.0
  • twitter-bootstrap3 Debian 14, Debian 13, Debian 12 3.4.0+dfsg-1

debian advisories DEBIAN-CVE-2016-10735

  • jss RHEL 8 4.7.3-1.module+el8.3.0+8058+d5cd4219
  • xsom RHEL 8 0-19.20110809svn.module+el8.1.0+3366+6dfb954c
  • slf4j RHEL 8 1.7.25-4.module+el8.1.0+3366+6dfb954c
  • pki-ca RHEL 8 10.9.4-1.module+el8.3.0+8058+d5cd4219
  • ldapjdk RHEL 8 4.22.0-1.module+el8.3.0+6784+6e1e4c62
  • pki-kra RHEL 8 10.9.4-1.module+el8.3.0+8058+d5cd4219
  • stax-ex RHEL 8 1.7.7-8.module+el8.2.0+5723+4574fbff
  • bea-stax RHEL 8 1.2.0-16.module+el8.1.0+3366+6dfb954c

red hat advisories RHSA-2020:4847RHSA-2020:4670RHSA-2023:0553RHSA-2023:0552RHSA-2023:0554RHBA-2019:4199

  • custodia AlmaLinux 8 0.6.0-3.module_el8.6.0+2881+2f24dc92
  • python3-pyusb AlmaLinux 8 1.0.0-9.module_el8.5.0+2641+983b221b
  • python3-pyusb AlmaLinux 8 1.0.0-9.module_el8.6.0+2881+2f24dc92
  • python3-pyusb AlmaLinux 8 1.0.0-9.module_el8.6.0+2737+7e73ea90
  • python3-qrcode AlmaLinux 8 5.1-12.module_el8.6.0+2881+2f24dc92
  • python3-qrcode AlmaLinux 8 5.1-12.module_el8.5.0+2641+983b221b
  • python3-qrcode AlmaLinux 8 5.1-12.module_el8.6.0+2737+7e73ea90
  • python3-yubico AlmaLinux 8 1.3.2-9.module_el8.5.0+2641+983b221b

almalinux advisories ALSA-2020:4670

  • xsom Rocky Linux 8 0-19.20110809svn.module+el8.3.0+53+ea062990
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.5.0+697+f586bb30
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.3.0+74+855e3f5d
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.3.0+133+b8b54b58
  • ldapjdk Rocky Linux 8 4.22.0-1.module+el8.4.0+418+b7ae1d4a
  • stax-ex Rocky Linux 8 1.7.7-8.module+el8.3.0+53+ea062990
  • bea-stax Rocky Linux 8 1.2.0-16.module+el8.3.0+53+ea062990
  • resteasy Rocky Linux 8 3.0.26-3.module+el8.3.0+53+ea062990

rocky linux advisories RLSA-2020:4847RLSA-2020:4670

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-10735 updated cvss 6.1

bootstrap: XSS in the data-target attribute

  • Red Hat Enterprise Linux 7 pki-ca, pki-kra, pki-base, pki-core, pki-tools, pki-server, +3 more
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Web Server 2 bootstrap Red Hat OpenStack Platform 8 (Liberty) python-XStatic-Bootstrap-SCSS Red Hat OpenStack Platform 9 (Mitaka) python-XStatic-Bootstrap-SCSS Red Hat OpenStack Platform 10 (Newton) python-XStatic-Bootstrap-SCSS Red Hat OpenStack Platform 14 (Rocky) python-XStatic-Bootstrap-SCSS, xstatic-bootstrap-scss-common Red Hat OpenStack Platform 15 (Stein) xstatic-bootstrap-scss-common, python3-XStatic-Bootstrap-SCSS
    affected: no fix available
  • Red Hat Satellite 5 bootstrap
    affected: no fix planned “Will not fix”
  • Red Hat Virtualization 4 ovirt-js-dependencies, ovirt-engine-dashboard
    affected: no fix planned “Out of support scope”
  • Red Hat CloudForms Management Engine 5.11 smem 1.4-1.el8cf, wmi 1.3.14-8.el8cf, prince 12.4-1.el8cf, cfme 5.11.0.28-1.el8cf, repmgr10 4.0.6-3.el8cf, qpid-proton 0.28.0-1.el8, +70 more
    fixed: vendor fix RHBA-2019:4199
  • Red Hat Decision Manager 7
    fixed: vendor fix RHSA-2020:0133
  • Red Hat Enterprise Linux AppStream (v. 8) jss 4.7.3-1.module+el8.3.0+8058+d5cd4219, ipa 4.8.7-12.module+el8.3.0+8222+c1bff54a, ipa 4.8.7-12.module+el8.3.0+8223+6212645f, pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, pyusb 1.0.0-9.module+el8.1.0+4107+4a66eb87, slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, +99 more
    fixed: vendor fix RHSA-2020:4847
  • Red Hat Enterprise Linux Client (v. 7) ipa 4.6.8-5.el7, ipa-client 4.6.8-5.el7, ipa-common 4.6.8-5.el7, python2-ipalib 4.6.8-5.el7, ipa-client-common 4.6.8-5.el7, ipa-python-compat 4.6.8-5.el7, +1 more Red Hat Enterprise Linux Client Optional (v. 7) ipa-server 4.6.8-5.el7, ipa-server-dns 4.6.8-5.el7, ipa-server-common 4.6.8-5.el7, python2-ipaserver 4.6.8-5.el7, ipa-server-trust-ad 4.6.8-5.el7 Red Hat Enterprise Linux ComputeNode (v. 7) ipa 4.6.8-5.el7, ipa-client 4.6.8-5.el7, ipa-common 4.6.8-5.el7, python2-ipalib 4.6.8-5.el7, ipa-client-common 4.6.8-5.el7, ipa-python-compat 4.6.8-5.el7, +1 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) ipa-server 4.6.8-5.el7, ipa-server-dns 4.6.8-5.el7, ipa-server-common 4.6.8-5.el7, python2-ipaserver 4.6.8-5.el7, ipa-server-trust-ad 4.6.8-5.el7 Red Hat Enterprise Linux Server (v. 7) ipa 4.6.8-5.el7, ipa-client 4.6.8-5.el7, ipa-common 4.6.8-5.el7, ipa-server 4.6.8-5.el7, ipa-server-dns 4.6.8-5.el7, python2-ipalib 4.6.8-5.el7, +6 more Red Hat Enterprise Linux Workstation (v. 7) ipa 4.6.8-5.el7, ipa-client 4.6.8-5.el7, ipa-common 4.6.8-5.el7, ipa-server 4.6.8-5.el7, ipa-server-dns 4.6.8-5.el7, python2-ipalib 4.6.8-5.el7, +6 more
    fixed: vendor fix RHSA-2020:3936
show 9 more
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-hal-console 3.3.16-1.Final_redhat_00001.1.el7eap
    fixed: vendor fix RHSA-2023:0552
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-hal-console 3.3.16-1.Final_redhat_00001.1.el8eap
    fixed: vendor fix RHSA-2023:0553
  • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-hal-console 3.3.16-1.Final_redhat_00001.1.el9eap
    fixed: vendor fix RHSA-2023:0554
  • Red Hat JBoss Enterprise Application Platform 7.4.9 hal-console 3.3.16.Final-redhat-00001
    fixed: vendor fix RHSA-2023:0556
  • Red Hat OpenStack Platform 13.0 python-XStatic-Bootstrap-SCSS 3.4.1.0-1.el7ost, xstatic-bootstrap-scss-common 3.4.1.0-1.el7ost Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server python-XStatic-Bootstrap-SCSS 3.4.1.0-1.el7ost, xstatic-bootstrap-scss-common 3.4.1.0-1.el7ost
    fixed: vendor fix RHSA-2020:5571
  • Red Hat Process Automation 7
    fixed: vendor fix RHSA-2020:0132
  • Red Hat Single Sign-On 7.3.2 zip
    fixed: vendor fix RHSA-2019:1456
  • Red Hat RHV-M 4.3 ovirt-engine-api-explorer 0.0.4-1.el7ev, ovirt-engine-api-explorer 0.0.5-1.el7ev, ovirt-engine-ui-extensions 1.0.10-1.el7ev
    fixed: vendor fix RHBA-2019:1076
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-jettison 1.5.2-1.redhat_00002.1.el7eap, eap7-wildfly 7.4.9-4.GA_redhat_00003.1.el7eap, eap7-apache-sshd 2.9.2-1.redhat_00001.1.el7eap, eap7-jackson-core 2.12.7-1.redhat_00003.1.el7eap, eap7-undertow 2.2.22-1.SP3_redhat_00001.1.el7eap, eap7-woodstox-core 6.4.0-1.redhat_00001.1.el7eap, +42 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-jettison 1.5.2-1.redhat_00002.1.el8eap, eap7-wildfly 7.4.9-4.GA_redhat_00003.1.el8eap, eap7-apache-sshd 2.9.2-1.redhat_00001.1.el8eap, eap7-jackson-core 2.12.7-1.redhat_00003.1.el8eap, eap7-undertow 2.2.22-1.SP3_redhat_00001.1.el8eap, eap7-woodstox-core 6.4.0-1.redhat_00001.1.el8eap, +40 more Red Hat JBoss EAP 7.4 for RHEL 9 eap7-jettison 1.5.2-1.redhat_00002.1.el9eap, eap7-wildfly 7.4.9-4.GA_redhat_00003.1.el9eap, eap7-apache-sshd 2.9.2-1.redhat_00001.1.el9eap, eap7-jackson-core 2.12.7-1.redhat_00003.1.el9eap, eap7-undertow 2.2.22-1.SP3_redhat_00001.1.el9eap, eap7-woodstox-core 6.4.0-1.redhat_00001.1.el9eap, +40 more Red Hat JBoss Enterprise Application Platform 7.4.9 pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, fs 2.1.2, ip 2.0.0, +1536 more Red Hat Quay 3 quay, quay/quay-rhel8
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-22-055-02 updated cvss 6.1

Mitsubishi Electric EcoWebServerIII

  • Mitsubishi Electric MES3-255C-CN >= 3.0.0, <= 3.3.0 Mitsubishi Electric MES3-255C-DM-CN >= 3.0.0, <= 3.3.0 Mitsubishi Electric MES3-255C-DM-EN >= 3.0.0, <= 3.3.0 Mitsubishi Electric MES3-255C-EN >= 3.0.0, <= 3.3.0
    affected: fixed in v3.3.1, mitigation “MES3-255C-DM-EN: Update to v3.3.1 or later” mitsubishielectric.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

4.04% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/twbs/bootstrap/issues/20184 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N
GitHub 3.0 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm bootstrap
>=2.0.4, <3.4.0
>=4.0.0-beta, <4.0.0-beta.2
3.4.0
4.0.0-beta.2
maven org.webjars:bootstrap
>=2.0.4, <3.4.0
>=4.0.0-beta, <4.0.0-beta.2
3.4.0
4.0.0-beta.2
rubygems bootstrap
<4.0.0-beta.2
4.0.0-beta.2
packagist twbs/bootstrap
>=2.0.4, <3.4.0
>=4.0.0-beta, <4.0.0-beta.2
3.4.0
4.0.0-beta.2
nuget bootstrap
>=2.0.4, <3.4.0
>=4.0.0-beta, <4.0.0-beta.2
3.4.0
4.0.0-beta.2
npm bootstrap-sass
>=2.0.4, <3.4.0
3.4.0
rubygems bootstrap-sass
>=2.0.4, <3.4.0
3.4.0
nuget bootstrap.sass
>=4.0.0-beta, <4.0.0-beta.2
4.0.0-beta.2

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.