Skip to content
Fencer Intel
medium 6.1

CVE-2018-14040 json

Bootstrap vulnerable to Cross-Site Scripting (XSS)

published 8y ago modified last mo. also GHSA-3wqf-4x89-9g79 , EUVD-2022-2255

cvss
6.1
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
4.1%
EPSS 4.1% chance of exploitation in 30 days, percentile 90%
public exploits
0
none known

Summary

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

Patch / fix

  • npm bootstrap 3.4.0, 4.1.2
  • rubygems bootstrap 3.4.0, 4.1.2
  • maven org.webjars:bootstrap 3.4.0, 4.1.2
  • nuget bootstrap 3.4.0, 4.1.2
  • nuget bootstrap.sass 4.1.2
  • rubygems bootstrap-sass 3.4.0
  • packagist twbs/bootstrap 3.4.0, 4.1.2
  • getbootstrap bootstrap 3.4.0, 4.1.2
  • twitter-bootstrap3 Debian 14, Debian 13, Debian 12 3.4.0+dfsg-1

debian advisories DEBIAN-CVE-2018-14040

  • jss RHEL 8 4.7.3-1.module+el8.3.0+8058+d5cd4219
  • xsom RHEL 8 0-19.20110809svn.module+el8.1.0+3366+6dfb954c
  • slf4j RHEL 8 1.7.25-4.module+el8.1.0+3366+6dfb954c
  • pki-ca RHEL 8 10.9.4-1.module+el8.3.0+8058+d5cd4219
  • ldapjdk RHEL 8 4.22.0-1.module+el8.3.0+6784+6e1e4c62
  • pki-kra RHEL 8 10.9.4-1.module+el8.3.0+8058+d5cd4219
  • stax-ex RHEL 8 1.7.7-8.module+el8.2.0+5723+4574fbff
  • bea-stax RHEL 8 1.2.0-16.module+el8.1.0+3366+6dfb954c

red hat advisories RHSA-2020:4847RHSA-2020:4670RHSA-2023:1043RHSA-2023:1044RHSA-2023:1045RHSA-2023:0553

  • custodia AlmaLinux 8 0.6.0-3.module_el8.6.0+2881+2f24dc92
  • python3-pyusb AlmaLinux 8 1.0.0-9.module_el8.5.0+2641+983b221b
  • python3-pyusb AlmaLinux 8 1.0.0-9.module_el8.6.0+2881+2f24dc92
  • python3-pyusb AlmaLinux 8 1.0.0-9.module_el8.6.0+2737+7e73ea90
  • python3-qrcode AlmaLinux 8 5.1-12.module_el8.6.0+2881+2f24dc92
  • python3-qrcode AlmaLinux 8 5.1-12.module_el8.5.0+2641+983b221b
  • python3-qrcode AlmaLinux 8 5.1-12.module_el8.6.0+2737+7e73ea90
  • python3-yubico AlmaLinux 8 1.3.2-9.module_el8.5.0+2641+983b221b

almalinux advisories ALSA-2020:4670

  • xsom Rocky Linux 8 0-19.20110809svn.module+el8.3.0+53+ea062990
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.5.0+697+f586bb30
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.3.0+74+855e3f5d
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.3.0+133+b8b54b58
  • ldapjdk Rocky Linux 8 4.22.0-1.module+el8.4.0+418+b7ae1d4a
  • stax-ex Rocky Linux 8 1.7.7-8.module+el8.3.0+53+ea062990
  • bea-stax Rocky Linux 8 1.2.0-16.module+el8.3.0+53+ea062990
  • resteasy Rocky Linux 8 3.0.26-3.module+el8.3.0+53+ea062990

rocky linux advisories RLSA-2020:4847RLSA-2020:4670

  • reaper CBL-Mariner 2.0 3.1.1-1

azure linux advisories AZL-13232

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2018-14040 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-14040 updated cvss 6.1

bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute

  • Red Hat Decision Manager 7 bootstrap Red Hat Enterprise Linux 7 pki-ca, pki-kra, pki-base, pki-core, pki-tools, pki-server, +3 more Red Hat OpenStack Platform 8 (Liberty) python-XStatic-Bootstrap-SCSS Red Hat OpenStack Platform 9 (Mitaka) python-XStatic-Bootstrap-SCSS Red Hat OpenStack Platform 10 (Newton) python-XStatic-Bootstrap-SCSS
    affected: no fix planned “Will not fix”
  • Red Hat OpenStack Platform 12 (Pike) python-XStatic-Bootstrap-SCSS, xstatic-bootstrap-scss-common
    affected: no fix available
  • Red Hat OpenStack Platform 13 (Queens) python-XStatic-Bootstrap-SCSS, xstatic-bootstrap-scss-common
    affected: no fix planned “Will not fix”
  • Red Hat OpenStack Platform 14 (Rocky) python-XStatic-Bootstrap-SCSS, xstatic-bootstrap-scss-common
    affected: no fix available
  • Red Hat Process Automation 7 bootstrap Red Hat Satellite 5 bootstrap Red Hat Virtualization 4 ovirt-js-dependencies
    affected: no fix planned “Will not fix”
  • Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-20
    fixed: vendor fix RHSA-2023:1047
  • Red Hat Enterprise Linux AppStream (v. 8) jss 4.7.3-1.module+el8.3.0+8058+d5cd4219, ipa 4.8.7-12.module+el8.3.0+8222+c1bff54a, ipa 4.8.7-12.module+el8.3.0+8223+6212645f, pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, pyusb 1.0.0-9.module+el8.1.0+4107+4a66eb87, slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, +99 more
    fixed: vendor fix RHSA-2020:4847
  • Red Hat Enterprise Linux Client (v. 7) ipa 4.6.8-5.el7, ipa-client 4.6.8-5.el7, ipa-common 4.6.8-5.el7, python2-ipalib 4.6.8-5.el7, ipa-client-common 4.6.8-5.el7, ipa-python-compat 4.6.8-5.el7, +1 more Red Hat Enterprise Linux Client Optional (v. 7) ipa-server 4.6.8-5.el7, ipa-server-dns 4.6.8-5.el7, ipa-server-common 4.6.8-5.el7, python2-ipaserver 4.6.8-5.el7, ipa-server-trust-ad 4.6.8-5.el7 Red Hat Enterprise Linux ComputeNode (v. 7) ipa 4.6.8-5.el7, ipa-client 4.6.8-5.el7, ipa-common 4.6.8-5.el7, python2-ipalib 4.6.8-5.el7, ipa-client-common 4.6.8-5.el7, ipa-python-compat 4.6.8-5.el7, +1 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) ipa-server 4.6.8-5.el7, ipa-server-dns 4.6.8-5.el7, ipa-server-common 4.6.8-5.el7, python2-ipaserver 4.6.8-5.el7, ipa-server-trust-ad 4.6.8-5.el7 Red Hat Enterprise Linux Server (v. 7) ipa 4.6.8-5.el7, ipa-client 4.6.8-5.el7, ipa-common 4.6.8-5.el7, ipa-server 4.6.8-5.el7, ipa-server-dns 4.6.8-5.el7, python2-ipalib 4.6.8-5.el7, +6 more Red Hat Enterprise Linux Workstation (v. 7) ipa 4.6.8-5.el7, ipa-client 4.6.8-5.el7, ipa-common 4.6.8-5.el7, ipa-server 4.6.8-5.el7, ipa-server-dns 4.6.8-5.el7, python2-ipalib 4.6.8-5.el7, +6 more
    fixed: vendor fix RHSA-2020:3936
show 9 more
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-hal-console 3.3.16-1.Final_redhat_00001.1.el7eap
    fixed: vendor fix RHSA-2023:0552
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-hal-console 3.3.16-1.Final_redhat_00001.1.el8eap
    fixed: vendor fix RHSA-2023:0553
  • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-hal-console 3.3.16-1.Final_redhat_00001.1.el9eap
    fixed: vendor fix RHSA-2023:0554
  • Red Hat JBoss Enterprise Application Platform 7.4.9 hal-console 3.3.16.Final-redhat-00001
    fixed: vendor fix RHSA-2023:0556
  • Red Hat Single Sign-On 7
    fixed: vendor fix RHSA-2023:1049
  • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2023:1043
  • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2023:1044
  • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el9sso
    fixed: vendor fix RHSA-2023:1045
  • Red Hat CloudForms Management Engine 5 cfme-gemset Red Hat 3scale API Management Platform 2 bootstrap Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-jettison 1.5.2-1.redhat_00002.1.el7eap, eap7-wildfly 7.4.9-4.GA_redhat_00003.1.el7eap, eap7-apache-sshd 2.9.2-1.redhat_00001.1.el7eap, eap7-jackson-core 2.12.7-1.redhat_00003.1.el7eap, eap7-undertow 2.2.22-1.SP3_redhat_00001.1.el7eap, eap7-woodstox-core 6.4.0-1.redhat_00001.1.el7eap, +42 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-jettison 1.5.2-1.redhat_00002.1.el8eap, eap7-wildfly 7.4.9-4.GA_redhat_00003.1.el8eap, eap7-apache-sshd 2.9.2-1.redhat_00001.1.el8eap, eap7-jackson-core 2.12.7-1.redhat_00003.1.el8eap, eap7-undertow 2.2.22-1.SP3_redhat_00001.1.el8eap, eap7-woodstox-core 6.4.0-1.redhat_00001.1.el8eap, +40 more Red Hat JBoss EAP 7.4 for RHEL 9 eap7-jettison 1.5.2-1.redhat_00002.1.el9eap, eap7-wildfly 7.4.9-4.GA_redhat_00003.1.el9eap, eap7-apache-sshd 2.9.2-1.redhat_00001.1.el9eap, eap7-jackson-core 2.12.7-1.redhat_00003.1.el9eap, eap7-undertow 2.2.22-1.SP3_redhat_00001.1.el9eap, eap7-woodstox-core 6.4.0-1.redhat_00001.1.el9eap, +40 more Red Hat JBoss Enterprise Application Platform 7.4.9 pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, fs 2.1.2, ip 2.0.0, +1536 more
    +2 more products
    Red Hat Quay 3 quay Red Hat Satellite 6 ruby193-rubygem-bootstrap-sass
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-22-055-02 updated cvss 7.5

Mitsubishi Electric EcoWebServerIII

  • Mitsubishi Electric MES3-255C-CN >= 3.0.0, <= 3.3.0 Mitsubishi Electric MES3-255C-DM-CN >= 3.0.0, <= 3.3.0 Mitsubishi Electric MES3-255C-DM-EN >= 3.0.0, <= 3.3.0 Mitsubishi Electric MES3-255C-EN >= 3.0.0, <= 3.3.0
    affected: fixed in v3.3.1, mitigation “MES3-255C-DM-EN: Update to v3.3.1 or later” mitsubishielectric.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

4.14% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/twbs/bootstrap/issues/26625 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N
GitHub 3.0 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm bootstrap
>=4.0.0, <4.1.2
>=2.3.0, <3.4.0
4.1.2
3.4.0
rubygems bootstrap
>=4.0.0, <4.1.2
>=2.3.0, <3.4.0
4.1.2
3.4.0
maven org.webjars:bootstrap
>=4.0.0, <4.1.2
>=2.3.0, <3.4.0
4.1.2
3.4.0
nuget bootstrap
>=2.3.0, <3.4.0
>=4.0.0, <4.1.2
3.4.0
4.1.2
nuget bootstrap.sass
>=4.0.0, <4.1.2
4.1.2
rubygems bootstrap-sass
>=2.3.0, <3.4.0
3.4.0
packagist twbs/bootstrap
>=2.3.0, <3.4.0
>=4.0.0, <4.1.2
3.4.0
4.1.2

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.