Launchpad.net

CVE 2019-8331

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

Related bugs and status

CVE-2019-8331 (Candidate) is related to these bugs:

Bug #1820226: [MIR] twitter-bootstrap3 as dependency of mailman3

Summary				In	Importance	Status
	1820226	[MIR] twitter-bootstrap3 as dependency of mailman3		twitter-bootstrap3 (Ubuntu)	Undecided	In Progress

Bug #1940450: XSS The data-template attribute of the tooltip and popover plugins lacks input sanitization and may allow attacker to execute arbitrary JavaScript.

		In	Importance	Status
1940450	XSS The data-template attribute of the tooltip and popover plugins lacks input sanitization and may allow attacker to execute arbitrary JavaScript.	OpenStack Dashboard (Horizon)	Undecided	Invalid
1940450	XSS The data-template attribute of the tooltip and popover plugins lacks input sanitization and may allow attacker to execute arbitrary JavaScript.	OpenStack Security Advisory	Undecided	Invalid
1940450	XSS The data-template attribute of the tooltip and popover plugins lacks input sanitization and may allow attacker to execute arbitrary JavaScript.	Ubuntu Cloud Archive	Undecided	New
1940450	XSS The data-template attribute of the tooltip and popover plugins lacks input sanitization and may allow attacker to execute arbitrary JavaScript.	python-xstatic-bootstrap-scss (Ubuntu)	Undecided	Won't Fix
1940450	XSS The data-template attribute of the tooltip and popover plugins lacks input sanitization and may allow attacker to execute arbitrary JavaScript.	horizon (Ubuntu)	Undecided	Won't Fix

See the

CVE page on Mitre.org for more details.

Launchpad.net

CVE 2019-8331

Related bugs and status

Related bugs

References