PT-2019-7534 · Twitter+4 · Bootstrap+4

Aasmacmx · Published 2019-01-09 · Updated 2025-09-29 · CVE-2016-10735

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Bootstrap versions 2.0.4 through 3.x before 3.4.0 Bootstrap versions 4.x-beta before 4.0.0-beta.2

Description XSS is possible in the data-target attribute. This issue is different from other known vulnerabilities.

Recommendations For Bootstrap versions 2.0.4 through 3.x before 3.4.0, update to version 3.4.0 or later to resolve the issue. For Bootstrap versions 4.x-beta before 4.0.0-beta.2, update to version 4.0.0-beta.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the data-target attribute until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALSA-2020:4670

ALSA-2025_16880

CESA-2020_3936

CESA-2020_4670

CESA-2020_4847

CVE-2016-10735

GHSA-4P24-VMCR-4GQJ

RHSA-2019:3023

RHSA-2020:3936

RHSA-2020:4670

RHSA-2020:4847

RHSA-2020:5571

RHSA-2020_3936

RHSA-2020_4670

RHSA-2020_4847

RHSA-2023:0552

RHSA-2023:0553

RHSA-2023:0554

RLSA-2020:4670

RLSA-2020:4847

Affected Products

Almalinux

Bootstrap

Centos

Red Hat

Rocky Linux

References · 139

• 🔥 https://github.com/twbs/bootstrap/issues/20184 · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap-sass/CVE-2016-10735.yml · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap/CVE-2016-10735.yml · Exploit
• https://github.com/twbs/bootstrap/pull/23687 · Patch
• https://osv.dev/vulnerability/GHSA-4p24-vmcr-4gqj · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:3023 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10735 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10735 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2020-4670.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:1456 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2020:0132 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-10735 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-10735 · Security Note
• https://access.redhat.com/errata/RHSA-2020:0133 · Vendor Advisory
• https://access.redhat.com/errata/RHBA-2019:1076 · Vendor Advisory