Skip to content
Fencer Vulns
medium 6.1

CVE-2019-8331 json

Bootstrap Vulnerable to Cross-Site Scripting

published 2019-02-20 7 y ago modified 2026-09-10 1 mo ago also GHSA-9v3m-8fp8-mj99 , EUVD-2019-0272

cvss
6.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
16.4%
EPSS 16.4% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

Patch / fix

  • rubygems bootstrap 4.3.1
  • rubygems bootstrap-sass 3.4.1
  • nuget Bootstrap.Less 3.4.1
  • nuget bootstrap 3.4.1, 4.3.1
  • nuget bootstrap.sass 4.3.1
  • npm bootstrap 3.4.1, 4.3.1
  • npm bootstrap-sass 3.4.1
  • rubygems twitter-bootstrap-rails 5.3.0
  • maven org.webjars:bootstrap 3.4.1, 4.3.1
  • packagist twbs/bootstrap 3.4.1, 4.3.1
  • getbootstrap bootstrap 3.4.1, 4.3.1
  • f5 big-ip_access_policy_manager 12.1.5.1, 13.1.3.4, 14.1.2.5, 15.1.0
  • f5 big-ip_advanced_firewall_manager 12.1.5.1, 13.1.3.4, 14.1.2.5, 15.1.0
  • f5 big-ip_analytics 12.1.5.1, 13.1.3.4, 14.1.2.5, 15.1.0
  • f5 big-ip_application_acceleration_manager 12.1.5.1, 13.1.3.4, 14.1.2.5, 15.1.0
  • f5 big-ip_application_security_manager 12.1.5.1, 13.1.3.4, 14.1.2.5, 15.1.0
  • f5 big-ip_domain_name_system 12.1.5.1, 13.1.3.4, 14.1.2.5, 15.1.0
  • f5 big-ip_edge_gateway 12.1.5.1, 13.1.3.4, 14.1.2.5, 15.1.0
  • f5 big-ip_fraud_protection_service 12.1.5.1, 13.1.3.4, 14.1.2.5, 15.1.0
  • f5 big-ip_global_traffic_manager 12.1.5.1, 13.1.3.4, 14.1.2.5, 15.1.0
  • f5 big-ip_link_controller 12.1.5.1, 13.1.3.4, 14.1.2.5, 15.1.0
  • f5 big-ip_local_traffic_manager 12.1.5.1, 13.1.3.4, 14.1.2.5, 15.1.0
  • f5 big-ip_policy_enforcement_manager 12.1.5.1, 13.1.3.4, 14.1.2.5, 15.1.0
  • f5 big-ip_webaccelerator 12.1.5.1, 13.1.3.4, 14.1.2.5, 15.1.0
  • tenable tenable.sc 5.19.0
  • twitter-bootstrap3 Debian 14, Debian 13, Debian 12 3.4.1+dfsg-1
  • twitter-bootstrap4 Debian 14, Debian 13, Debian 12 4.3.1+dfsg2-1

debian advisories DEBIAN-CVE-2019-8331

  • jss RHEL 8 4.7.3-1.module+el8.3.0+8058+d5cd4219
  • xsom RHEL 8 0-19.20110809svn.module+el8.1.0+3366+6dfb954c
  • slf4j RHEL 8 1.7.25-4.module+el8.1.0+3366+6dfb954c
  • pki-ca RHEL 8 10.9.4-1.module+el8.3.0+8058+d5cd4219
  • ldapjdk RHEL 8 4.22.0-1.module+el8.3.0+6784+6e1e4c62
  • pki-kra RHEL 8 10.9.4-1.module+el8.3.0+8058+d5cd4219
  • stax-ex RHEL 8 1.7.7-8.module+el8.2.0+5723+4574fbff
  • bea-stax RHEL 8 1.2.0-16.module+el8.1.0+3366+6dfb954c

red hat advisories RHSA-2020:4847RHSA-2020:4670RHSA-2023:0553RHSA-2023:0552RHSA-2023:0554RHSA-2020:3247

  • custodia AlmaLinux 8 0.6.0-3.module_el8.6.0+2881+2f24dc92
  • python3-pyusb AlmaLinux 8 1.0.0-9.module_el8.5.0+2641+983b221b
  • python3-pyusb AlmaLinux 8 1.0.0-9.module_el8.6.0+2881+2f24dc92
  • python3-pyusb AlmaLinux 8 1.0.0-9.module_el8.6.0+2737+7e73ea90
  • python3-qrcode AlmaLinux 8 5.1-12.module_el8.6.0+2881+2f24dc92
  • python3-qrcode AlmaLinux 8 5.1-12.module_el8.5.0+2641+983b221b
  • python3-qrcode AlmaLinux 8 5.1-12.module_el8.6.0+2737+7e73ea90
  • python3-yubico AlmaLinux 8 1.3.2-9.module_el8.5.0+2641+983b221b

almalinux advisories ALSA-2020:4670

  • xsom Rocky Linux 8 0-19.20110809svn.module+el8.3.0+53+ea062990
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.5.0+697+f586bb30
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.3.0+74+855e3f5d
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.3.0+133+b8b54b58
  • ldapjdk Rocky Linux 8 4.22.0-1.module+el8.4.0+418+b7ae1d4a
  • stax-ex Rocky Linux 8 1.7.7-8.module+el8.3.0+53+ea062990
  • bea-stax Rocky Linux 8 1.2.0-16.module+el8.3.0+53+ea062990
  • resteasy Rocky Linux 8 3.0.26-3.module+el8.3.0+53+ea062990

rocky linux advisories RLSA-2020:4847RLSA-2020:4670

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-8331 updated cvss 6.1

bootstrap: XSS in the tooltip or popover data-template attribute

  • Red Hat Decision Manager 7 bootstrap Red Hat Enterprise Linux 7 pki-ca, pki-kra, pki-base, pki-core, pki-tools, pki-server, +3 more
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Web Server 2 bootstrap
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Application Runtimes bootstrap
    affected: no fix available
  • Red Hat OpenShift Container Platform 3.11 openshift3/ose-console
    affected: no fix planned “Out of support scope”
  • Red Hat OpenStack Platform 8 (Liberty) python-XStatic-Bootstrap-SCSS Red Hat OpenStack Platform 9 (Mitaka) python-XStatic-Bootstrap-SCSS Red Hat OpenStack Platform 10 (Newton) python-XStatic-Bootstrap-SCSS
    affected: no fix planned “Will not fix”
  • Red Hat OpenStack Platform 14 (Rocky) python-XStatic-Bootstrap-SCSS, xstatic-bootstrap-scss-common
    affected: no fix available
  • Red Hat OpenStack Platform 15 (Stein) xstatic-bootstrap-scss-common, python3-XStatic-Bootstrap-SCSS Red Hat Process Automation 7 bootstrap
    affected: no fix planned “Will not fix”
  • Red Hat Satellite 5 bootstrap Red Hat Virtualization 4 ovirt-js-dependencies, ovirt-engine-dashboard
    affected: no fix planned “Out of support scope”
show 14 more
  • Red Hat Enterprise Linux AppStream (v. 8) jss 4.7.3-1.module+el8.3.0+8058+d5cd4219, ipa 4.8.7-12.module+el8.3.0+8222+c1bff54a, ipa 4.8.7-12.module+el8.3.0+8223+6212645f, pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, pyusb 1.0.0-9.module+el8.1.0+4107+4a66eb87, slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, +99 more
    fixed: vendor fix RHSA-2020:4847
  • Red Hat Enterprise Linux Client (v. 7) ipa 4.6.8-5.el7, ipa-client 4.6.8-5.el7, ipa-common 4.6.8-5.el7, python2-ipalib 4.6.8-5.el7, ipa-client-common 4.6.8-5.el7, ipa-python-compat 4.6.8-5.el7, +1 more Red Hat Enterprise Linux Client Optional (v. 7) ipa-server 4.6.8-5.el7, ipa-server-dns 4.6.8-5.el7, ipa-server-common 4.6.8-5.el7, python2-ipaserver 4.6.8-5.el7, ipa-server-trust-ad 4.6.8-5.el7 Red Hat Enterprise Linux ComputeNode (v. 7) ipa 4.6.8-5.el7, ipa-client 4.6.8-5.el7, ipa-common 4.6.8-5.el7, python2-ipalib 4.6.8-5.el7, ipa-client-common 4.6.8-5.el7, ipa-python-compat 4.6.8-5.el7, +1 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) ipa-server 4.6.8-5.el7, ipa-server-dns 4.6.8-5.el7, ipa-server-common 4.6.8-5.el7, python2-ipaserver 4.6.8-5.el7, ipa-server-trust-ad 4.6.8-5.el7 Red Hat Enterprise Linux Server (v. 7) ipa 4.6.8-5.el7, ipa-client 4.6.8-5.el7, ipa-common 4.6.8-5.el7, ipa-server 4.6.8-5.el7, ipa-server-dns 4.6.8-5.el7, python2-ipalib 4.6.8-5.el7, +6 more Red Hat Enterprise Linux Workstation (v. 7) ipa 4.6.8-5.el7, ipa-client 4.6.8-5.el7, ipa-common 4.6.8-5.el7, ipa-server 4.6.8-5.el7, ipa-server-dns 4.6.8-5.el7, python2-ipalib 4.6.8-5.el7, +6 more
    fixed: vendor fix RHSA-2020:3936
  • Red Hat Fuse 7.11.1
    fixed: vendor fix RHSA-2022:8652
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-hal-console 3.3.16-1.Final_redhat_00001.1.el7eap
    fixed: vendor fix RHSA-2023:0552
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-hal-console 3.3.16-1.Final_redhat_00001.1.el8eap
    fixed: vendor fix RHSA-2023:0553
  • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-hal-console 3.3.16-1.Final_redhat_00001.1.el9eap
    fixed: vendor fix RHSA-2023:0554
  • Red Hat JBoss Enterprise Application Platform 7.4.9 hal-console 3.3.16.Final-redhat-00001
    fixed: vendor fix RHSA-2023:0556
  • Red Hat OpenStack Platform 13.0 python-XStatic-Bootstrap-SCSS 3.4.1.0-1.el7ost, xstatic-bootstrap-scss-common 3.4.1.0-1.el7ost Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server python-XStatic-Bootstrap-SCSS 3.4.1.0-1.el7ost, xstatic-bootstrap-scss-common 3.4.1.0-1.el7ost
    fixed: vendor fix RHSA-2020:5571
  • Red Hat OpenStack Platform 16.1 python-XStatic-Bootstrap-SCSS 3.4.1.0-2.el8ost
    fixed: vendor fix RHSA-2022:8865
  • Red Hat OpenStack Platform 16.2 python-XStatic-Bootstrap-SCSS 3.4.1.0-2.el8ost, xstatic-bootstrap-scss-common 3.4.1.0-2.el8ost, python3-XStatic-Bootstrap-SCSS 3.4.1.0-2.el8ost
    fixed: vendor fix RHSA-2022:8848
  • Red Hat Single Sign-On 7.3.2 zip
    fixed: vendor fix RHSA-2019:1456
  • Red Hat RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 rhvm 4.4.1.8-0.7.el8ev, ovirt-engine 4.4.1.8-0.7.el8ev, ovirt-engine-setup 4.4.1.8-0.7.el8ev, ovirt-engine-tools 4.4.1.8-0.7.el8ev, ovirt-engine-backend 4.4.1.8-0.7.el8ev, ovirt-engine-restapi 4.4.1.8-0.7.el8ev, +15 more
    fixed: vendor fix RHSA-2020:3247
  • Red Hat RHV-M 4.3 ovirt-web-ui 1.6.0-1.el7ev, ovirt-engine-ui-extensions 1.0.10-1.el7ev
    fixed: vendor fix RHSA-2019:3023
  • Red Hat CloudForms Management Engine 5 cfme-gemset Red Hat 3scale API Management Platform 2 bootstrap Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-jettison 1.5.2-1.redhat_00002.1.el7eap, eap7-wildfly 7.4.9-4.GA_redhat_00003.1.el7eap, eap7-apache-sshd 2.9.2-1.redhat_00001.1.el7eap, eap7-jackson-core 2.12.7-1.redhat_00003.1.el7eap, eap7-undertow 2.2.22-1.SP3_redhat_00001.1.el7eap, eap7-woodstox-core 6.4.0-1.redhat_00001.1.el7eap, +42 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-jettison 1.5.2-1.redhat_00002.1.el8eap, eap7-wildfly 7.4.9-4.GA_redhat_00003.1.el8eap, eap7-apache-sshd 2.9.2-1.redhat_00001.1.el8eap, eap7-jackson-core 2.12.7-1.redhat_00003.1.el8eap, eap7-undertow 2.2.22-1.SP3_redhat_00001.1.el8eap, eap7-woodstox-core 6.4.0-1.redhat_00001.1.el8eap, +40 more Red Hat JBoss EAP 7.4 for RHEL 9 eap7-jettison 1.5.2-1.redhat_00002.1.el9eap, eap7-wildfly 7.4.9-4.GA_redhat_00003.1.el9eap, eap7-apache-sshd 2.9.2-1.redhat_00001.1.el9eap, eap7-jackson-core 2.12.7-1.redhat_00003.1.el9eap, eap7-undertow 2.2.22-1.SP3_redhat_00001.1.el9eap, eap7-woodstox-core 6.4.0-1.redhat_00001.1.el9eap, +40 more Red Hat JBoss Enterprise Application Platform 7.4.9 pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, fs 2.1.2, ip 2.0.0, +1536 more
    +2 more products
    Red Hat OpenStack Platform 16.1 xstatic-bootstrap-scss-common 3.4.1.0-2.el8ost, python3-XStatic-Bootstrap-SCSS 3.4.1.0-2.el8ost Red Hat OpenStack Platform 16.2 qpid-dispatch-tools, qpid-dispatch-router
    not affected: vulnerable code not present

3 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

16.40% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N
GitHub 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
rubygems bootstrap
<4.3.1
4.3.1
rubygems bootstrap-sass
>=3.0.0, <3.4.1
3.4.1
nuget Bootstrap.Less
>=3.0.0, <3.4.1
3.4.1
nuget bootstrap
>=4.0.0, <4.3.1
>=3.0.0, <3.4.1
4.3.1
3.4.1
nuget bootstrap.sass
<4.3.1
4.3.1
npm bootstrap
>=4.0.0, <4.3.1
>=3.0.0, <3.4.1
4.3.1
3.4.1
npm bootstrap-sass
>=3.0.0, <3.4.1
3.4.1
rubygems twitter-bootstrap-rails
<5.3.0
5.3.0
maven org.webjars:bootstrap
>=3.0.0, <3.4.1
>=4.0.0, <4.3.1
3.4.1
4.3.1
packagist twbs/bootstrap
>=3.0.0, <3.4.1
>=4.0.0, <4.3.1
3.4.1
4.3.1

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.