[Pkg-javascript-devel] Bug#1084059: twitter-bootstrap4: CVE-2024-6531

Moritz Mühlenhoff jmm at inutil.org
Fri Oct 4 16:18:46 BST 2024


Source: twitter-bootstrap4
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for twitter-bootstrap4.

CVE-2024-6531[0]:
| A vulnerability has been identified in Bootstrap that exposes users
| to Cross-Site Scripting (XSS) attacks. The issue is present in the
| carousel component, where the data-slide and data-slide-to
| attributes can be exploited through the href attribute of an <a> tag
| due to inadequate sanitization. This vulnerability could potentially
| enable attackers to execute arbitrary JavaScript within the victim's
| browser.

https://www.herodevs.com/vulnerability-directory/cve-2024-6531

But I think the bigger issue is that Bootstrap 3 and 4 are EOLed,
so possibly Debian should move to use 5 instead?

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-6531
    https://www.cve.org/CVERecord?id=CVE-2024-6531

Please adjust the affected versions in the BTS as needed.



More information about the Pkg-javascript-devel mailing list