Cross-site scripting in Bootstrap - CVE-2019-8331

Vulnerability identifier: #VU17694

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2019-8331

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Bootstrap
watsonx.data
EcoWebServerIII MES3-255C-DM-CN
EcoWebServerIII MES3-255C-DM-EN
EcoWebServerIII MES3-255C-CN
EcoWebServerIII MES3-255C-EN
Red Hat OpenStack for IBM Power
Red Hat OpenStack
IBM Aspera Orchestrator
QRadar User Behavior Analytics
Engineering Workflow Management
IBM Maximo Asset Management
IBM Common Licensing
IBM Security Verify Governance
IBM Business Automation Workflow
IBM Security Verify Information Queue
Storage Ceph
MobileFirst Platform
Solutions Enabler
Unisphere for PowerMax Virtual Appliance
Unisphere for PowerMax
ipa (Red Hat package)
eap7-jboss-jsp (Red Hat package)
eap7-jboss-jsf (Red Hat package)
eap7-javaee-security-soteria (Red Hat package)
eap7-jettison (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-elytron-web (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-undertow (Red Hat package)
eap7-apache-sshd (Red Hat package)
eap7-jackson-jaxrs-providers (Red Hat package)
eap7-jackson-modules-base (Red Hat package)
eap7-jackson-modules-java8 (Red Hat package)
eap7-jackson-databind (Red Hat package)
eap7-jackson-core (Red Hat package)
eap7-jackson-annotations (Red Hat package)
eap7-hal-console (Red Hat package)
python-XStatic-Bootstrap-SCSS (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
eap7-jboss-remoting (Red Hat package)
eap7-hibernate-search (Red Hat package)
eap7-woodstox-core (Red Hat package)
eap7-wildfly (Red Hat package)
Red Hat Virtualization Manager
IBM Edge Application Manager
KinagaCMS
Tenable.sc
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
JBoss Enterprise Application Platform
Fuse
IBM Storage Scale System
IBM Qradar SIEM
Solutions Enabler Virtual Appliance

The vulnerability has been addressed in the versions 3.4.1, 4.3.1.

Bootstrap - addressed in versions 3.4.1, 4.3.1
EcoWebServerIII MES3-255C-DM-CN - update to 3.3.1
EcoWebServerIII MES3-255C-DM-EN - update to 3.3.1
EcoWebServerIII MES3-255C-CN - update to 3.3.1
EcoWebServerIII MES3-255C-EN - update to 3.3.1
IBM Security Verify Information Queue - update to 1.0.6
ipa (Red Hat package) - update to 4.6.8-5.el7
KinagaCMS - update to 6.5
Tenable.sc - update to 5.19.0
JBoss Enterprise Application Platform - update to 7.4.9
Fuse - update to 7.11.1
Red Hat OpenStack - addressed in versions 16.1.9, 16.2.4
eap7-jboss-jsp (Red Hat package) - addressed in versions api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el7eap, api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el8eap, api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el9eap
eap7-jboss-jsf (Red Hat package) - addressed in versions api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el7eap, api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el8eap, api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el9eap
eap7-javaee-security-soteria (Red Hat package) - addressed in versions 1.0.1-3.redhat_00003.1.el7eap, 1.0.1-3.redhat_00003.1.el8eap, 1.0.1-3.redhat_00003.1.el9eap
eap7-jettison (Red Hat package) - addressed in versions 1.5.2-1.redhat_00002.1.el7eap, 1.5.2-1.redhat_00002.1.el8eap, 1.5.2-1.redhat_00002.1.el9eap
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.10-1.Final_redhat_00001.1.el7eap, 1.5.10-1.Final_redhat_00001.1.el8eap, 1.5.10-1.Final_redhat_00001.1.el9eap
eap7-elytron-web (Red Hat package) - addressed in versions 1.9.3-1.Final_redhat_00001.1.el7eap, 1.9.3-1.Final_redhat_00001.1.el8eap, 1.9.3-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-24.Final_redhat_00023.1.el7eap, 1.10.0-24.Final_redhat_00023.1.el8eap, 1.10.0-24.Final_redhat_00023.1.el9eap
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.16-1.Final_redhat_00001.1.el7eap, 1.15.16-1.Final_redhat_00001.1.el8eap, 1.15.16-1.Final_redhat_00001.1.el9eap
watsonx.data - update to 2.1.1
eap7-undertow (Red Hat package) - addressed in versions 2.2.22-1.SP3_redhat_00001.1.el7eap, 2.2.22-1.SP3_redhat_00001.1.el8eap, 2.2.22-1.SP3_redhat_00001.1.el9eap
eap7-apache-sshd (Red Hat package) - addressed in versions 2.9.2-1.redhat_00001.1.el7eap, 2.9.2-1.redhat_00001.1.el8eap, 2.9.2-1.redhat_00001.1.el9eap
eap7-jackson-jaxrs-providers (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-modules-base (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-modules-java8 (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-databind (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-core (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-annotations (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.16-1.Final_redhat_00001.1.el7eap, 3.3.16-1.Final_redhat_00001.1.el8eap, 3.3.16-1.Final_redhat_00001.1.el9eap
python-XStatic-Bootstrap-SCSS (Red Hat package) - addressed in versions 3.4.1.0-1.el7ost, 3.4.1.0-2.el8ost
IBM Aspera Orchestrator - update to 4.0.1 PL2
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.49-1.Final_redhat_00001.1.el7eap, 4.0.49-1.Final_redhat_00001.1.el8eap, 4.0.49-1.Final_redhat_00001.1.el9eap
QRadar User Behavior Analytics - update to 4.1.17
eap7-jboss-remoting (Red Hat package) - addressed in versions 5.0.27-1.Final_redhat_00001.1.el7eap, 5.0.27-1.Final_redhat_00001.1.el8eap, 5.0.27-1.Final_redhat_00001.1.el9eap
IBM Storage Scale System - addressed in versions 5.1.9.5, 5.2.0.0
eap7-hibernate-search (Red Hat package) - addressed in versions 5.10.13-3.Final_redhat_00001.1.el7eap, 5.10.13-3.Final_redhat_00001.1.el8eap, 5.10.13-3.Final_redhat_00001.1.el9eap
Storage Ceph - update to 6.1z2
eap7-woodstox-core (Red Hat package) - addressed in versions 6.4.0-1.redhat_00001.1.el7eap, 6.4.0-1.redhat_00001.1.el8eap, 6.4.0-1.redhat_00001.1.el9eap
Engineering Workflow Management - addressed in versions 7.0.1 iFix021, 7.0.2 iFix021
eap7-wildfly (Red Hat package) - addressed in versions 7.4.9-4.GA_redhat_00003.1.el7eap, 7.4.9-4.GA_redhat_00003.1.el8eap, 7.4.9-4.GA_redhat_00003.1.el9eap
IBM Qradar SIEM - update to 7.5.0 Update Pack 6
IBM Maximo Asset Management - update to 7.6.1.2.0.31
MobileFirst Platform - update to 8.0.0.0-MFPF-IF202304111626
IBM Common Licensing - update to 9.0.0.1
Solutions Enabler Virtual Appliance - addressed in versions 9.0.0.19, 9.1.0.10
Solutions Enabler - addressed in versions 9.0.0.19, 9.1.0.10
Unisphere for PowerMax Virtual Appliance - addressed in versions 9.0.2.19, 9.1.0.20
Unisphere for PowerMax - addressed in versions 9.0.2.19, 9.1.0.20
IBM Security Verify Governance - update to 10.0.2.0.1
IBM Business Automation Workflow - addressed in versions 21.0.3 IF019, 22.0.2 IF003

• https://blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1/

• Cross-site scripting in Bootstrap
• Cross-site scripting in KinagaCMS
• Red Hat update for ovirt-engine-ui-extensions
• Red Hat update for ovirt-web-ui
• Red Hat Enterprise Linux 7 update for ipa
• Red Hat Enterprise Linux 8 update for the idm:DL1 and idm:client modules
• Red Hat OpenStack update for python-XStatic-Bootstrap-SCSS
• Multiple vulnerabilities in Tenable.sc
• Multiple vulnerabilities in Mitsubishi Electric EcoWebServerIII
• Multiple vulnerabilities in Dell EMC Unisphere for PowerMax and Dell EMC Solutions Enabler
• Multiple vulnerabilities in Red Hat Fuse
• Red Hat OpenStack 16.2 update for python-XStatic-Bootstrap-SCSS
• Red Hat OpenStack 16.1 update for python-XStatic-Bootstrap-SCSS
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 7
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in IBM Maximo Asset Management
• Multiple vulnerabilities in IBM Engineering Workflow Management (EWM)
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in IBM Security Information Queue
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in IBM Aspera Orchestrator
• Multiple vulnerabilities in IBM MobileFirst Platform Foundation
• Multiple vulnerabilities in IBM Storage Ceph
• Multiple vulnerabilities in IBM Storage Scale
• Multiple vulnerabilities in IBM Common Licensing
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Multiple vulnerabilities in IBM watsonx.data