CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2019-8331
Medium (6.1). EPSS 16% chance of exploitation in the next 30 days. Fixed in bootstrap 3.4.1, 4.3.1.
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
Severity
- EPSS
- 16% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- f5:big-ip_access_policy_manager
- f5:big-ip_advanced_firewall_manager
- f5:big-ip_analytics
- f5:big-ip_application_acceleration_manager
- f5:big-ip_application_security_manager
- f5:big-ip_domain_name_system
- f5:big-ip_edge_gateway
- f5:big-ip_fraud_protection_service
- f5:big-ip_global_traffic_manager
- f5:big-ip_link_controller
- f5:big-ip_local_traffic_manager
- f5:big-ip_policy_enforcement_manager
- f5:big-ip_webaccelerator
- getbootstrap:bootstrap
- redhat:virtualization_manager
- tenable:tenable.sc
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9v3m-8fp8-mj99 | RubyGems | bootstrap | <4.3.1 | 4.3.1 |
| GHSA-9v3m-8fp8-mj99 | RubyGems | bootstrap-sass | >=3.0.0 <3.4.1 | 3.4.1 |
| GHSA-9v3m-8fp8-mj99 | NuGet | Bootstrap.Less | >=3.0.0 <3.4.1 | 3.4.1 |
| GHSA-9v3m-8fp8-mj99 | NuGet | bootstrap | >=4.0.0 <4.3.1 | 4.3.1 |
| GHSA-9v3m-8fp8-mj99 | NuGet | bootstrap | >=3.0.0 <3.4.1 | 3.4.1 |
| GHSA-9v3m-8fp8-mj99 | NuGet | bootstrap.sass | <4.3.1 | 4.3.1 |
| GHSA-9v3m-8fp8-mj99 | npm | bootstrap | >=4.0.0 <4.3.1 | 4.3.1 |
| GHSA-9v3m-8fp8-mj99 | npm | bootstrap | >=3.0.0 <3.4.1 | 3.4.1 |
| GHSA-9v3m-8fp8-mj99 | npm | bootstrap-sass | >=3.0.0 <3.4.1 | 3.4.1 |
| GHSA-9v3m-8fp8-mj99 | RubyGems | twitter-bootstrap-rails | <5.3.0 | 5.3.0 |
| GHSA-9v3m-8fp8-mj99 | Maven | org.webjars:bootstrap | >=3.0.0 <3.4.1 | 3.4.1 |
| GHSA-9v3m-8fp8-mj99 | Maven | org.webjars:bootstrap | >=4.0.0 <4.3.1 | 4.3.1 |
| GHSA-9v3m-8fp8-mj99 | Packagist | twbs/bootstrap | >=3.0.0 <3.4.1 | 3.4.1 |
| GHSA-9v3m-8fp8-mj99 | Packagist | twbs/bootstrap | >=4.0.0 <4.3.1 | 4.3.1 |