Cross-site scripting in Bootstrap - CVE-2024-6484

Vulnerability identifier: #VU97687

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2024-6484

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data passed via the <a> anchor element when used for carousel navigation with a data-slide or data-slide-to attribute. A remote attacker can execute arbitrary JavaScript code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Bootstrap
IBM Cloud Pak System
Ubuntu
IBM Security SOAR
twitter-bootstrap3 (Ubuntu package)
Engineering Workflow Management
IBM API Connect

Install updates from vendor's website.

Bootstrap - update to 4.0.0
IBM Cloud Pak System - update to 2.3.5.1
IBM Security SOAR - update to 51.0.7.1
twitter-bootstrap3 (Ubuntu package) - addressed in versions 3.3.6+dfsg-1ubuntu0.1~esm1, 3.3.7+dfsg-2ubuntu0.1~esm1, 3.4.1+dfsg-1ubuntu0.1~esm1, 3.4.1+dfsg-3+deb12u1build0.24.04.1, 3.4.1+dfsg-3+deb12u1build0.24.10.1, 3.4.1+dfsg-3+deb12u1build0.25.04.1, 3.4.1+dfsg-2+deb11u2build0.22.04.1, 4.4.1+dfsg1-2ubuntu0.1~esm1, 4.6.0+dfsg1-4ubuntu0.1~esm1, 4.6.1+dfsg1-4+deb12u1build0.24.04.1, 4.6.1+dfsg1-4+deb12u1build0.24.10.1
Engineering Workflow Management - addressed in versions 7.0.3 ifix021, 7.1 ifix007
IBM API Connect - update to 10.0.9.0

• https://www.herodevs.com/vulnerability-directory/cve-2024-6484

• Multiple XSS vulnerabilities in Bootstrap 2 and 3
• Multiple vulnerabilities in IBM API Connect
• Ubuntu update for twitter-bootstrap3
• Multiple vulnerabilities in IBM Security SOAR
• Multiple vulnerabilities in IBM Engineering Workflow Management
• Multiple vulnerabilities in IBM Cloud Pak System