[Pkg-javascript-devel] Bug#1084059: twitter-bootstrap4: CVE-2024-6531
Moritz Mühlenhoff
jmm at inutil.org
Fri Oct 4 16:18:46 BST 2024
Source: twitter-bootstrap4
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security
Hi,
The following vulnerability was published for twitter-bootstrap4.
CVE-2024-6531[0]:
| A vulnerability has been identified in Bootstrap that exposes users
| to Cross-Site Scripting (XSS) attacks. The issue is present in the
| carousel component, where the data-slide and data-slide-to
| attributes can be exploited through the href attribute of an <a> tag
| due to inadequate sanitization. This vulnerability could potentially
| enable attackers to execute arbitrary JavaScript within the victim's
| browser.
https://www.herodevs.com/vulnerability-directory/cve-2024-6531
But I think the bigger issue is that Bootstrap 3 and 4 are EOLed,
so possibly Debian should move to use 5 instead?
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2024-6531
https://www.cve.org/CVERecord?id=CVE-2024-6531
Please adjust the affected versions in the BTS as needed.
More information about the Pkg-javascript-devel
mailing list