PT-2019-5302 · Twitter+4 · Bootstrap+4

Published 2019-02-20 · Updated 2025-11-30 · CVE-2019-8331

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Bootstrap versions prior to 3.4.1 for 3.x and 4.3.1 for 4.x

Description The issue is related to Cross-Site Scripting (XSS) in the tooltip or popover data-template attribute of the Bootstrap toolkit. This is due to a lack of input sanitization, which may allow an attacker to execute arbitrary JavaScript. The vulnerability can be exploited by a remote attacker to perform cross-site scripting attacks.

Recommendations For Bootstrap 4.x, upgrade to 4.3.1 or later. For Bootstrap 3.x, upgrade to 3.4.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALSA-2020:4670

ALSA-2025_16880

BDU:2020-02249

CESA-2020_3936

CESA-2020_4670

CESA-2020_4847

CVE-2019-8331

GHSA-9V3M-8FP8-MJ99

RHSA-2019:3023

RHSA-2019:3024

RHSA-2020:3247

RHSA-2020:3936

RHSA-2020:4670

RHSA-2020:4847

RHSA-2020:5571

RHSA-2020_3936

RHSA-2020_4670

RHSA-2020_4847

RHSA-2022:8848

RHSA-2022:8865

RHSA-2023:0552

RHSA-2023:0553

RHSA-2023:0554

RLSA-2020:4670

RLSA-2020:4847

Affected Products

Almalinux

Bootstrap

Centos

Red Hat

Rocky Linux

References · 172

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap/CVE-2019-8331.yml · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/twitter-bootstrap-rails/CVE-2019-8331.yml · Exploit
• 🔥 https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854@%3Cuser.flink.apache.org%3E · Exploit
• 🔥 https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731@%3Cdev.flink.apache.org%3E · Exploit
• 🔥 https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49@%3Cuser.flink.apache.org%3E · Exploit
• https://github.com/twbs/bootstrap/pull/28236 · Patch
• https://ubuntu.com/security/CVE-2019-8331 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9v3m-8fp8-mj99 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-8331 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-8331 · Security Note
• https://access.redhat.com/errata/RHSA-2019:3023 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:3024 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02249 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-8331 · Vendor Advisory
• https://blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1 · Vendor Advisory