Read the docs
TI-2016-08775 Aliases CVE-2016-10735GHSA-4p24-vmcr-4gqj

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the…

Priority LOW 34CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 18 fixed, 9 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

Why it matters now

EPSS 0.0404 90th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial bootstrap (npm): 3.4.0, 4.0.0-beta.2org.webjars:bootstrap (Maven): 3.4.0, 4.0.0-beta.2+6 more productsRed Hat: 12 advisoriesRed Hat: 18 fixed, 9 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—bootstrap (npm)2.0.4 to before 3.4.03.4.0Patch availableGHSA-4p24-vmcr-4gqj
—bootstrap (npm)4.0.0-beta to before 4.0.0-beta.24.0.0-beta.2Patch availableGHSA-4p24-vmcr-4gqj
—org.webjars:bootstrap (Maven)2.0.4 to before 3.4.03.4.0Patch availableGHSA-4p24-vmcr-4gqj
—org.webjars:bootstrap (Maven)4.0.0-beta to before 4.0.0-beta.24.0.0-beta.2Patch availableGHSA-4p24-vmcr-4gqj
—bootstrap (RubyGems)before 4.0.0-beta.24.0.0-beta.2Patch availableGHSA-4p24-vmcr-4gqj
—twbs/bootstrap (Packagist)2.0.4 to before 3.4.03.4.0Patch availableGHSA-4p24-vmcr-4gqj
—twbs/bootstrap (Packagist)4.0.0-beta to before 4.0.0-beta.24.0.0-beta.2Patch availableGHSA-4p24-vmcr-4gqj
—bootstrap (NuGet)2.0.4 to before 3.4.03.4.0Patch availableGHSA-4p24-vmcr-4gqj
—bootstrap (NuGet)4.0.0-beta to before 4.0.0-beta.24.0.0-beta.2Patch availableGHSA-4p24-vmcr-4gqj
—bootstrap-sass (npm)2.0.4 to before 3.4.03.4.0Patch availableGHSA-4p24-vmcr-4gqj
—bootstrap-sass (RubyGems)2.0.4 to before 3.4.03.4.0Patch availableGHSA-4p24-vmcr-4gqj
—bootstrap.sass (NuGet)4.0.0-beta to before 4.0.0-beta.24.0.0-beta.2Patch availableGHSA-4p24-vmcr-4gqj
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • bootstrap (npm) Vendor— Affected 2.0.4 to before 3.4.0 Fixed in 3.4.0 Patch available GHSA-4p24-vmcr-4gqj
  • bootstrap (npm) Vendor— Affected 4.0.0-beta to before 4.0.0-beta.2 Fixed in 4.0.0-beta.2 Patch available GHSA-4p24-vmcr-4gqj
  • org.webjars:bootstrap (Maven) Vendor— Affected 2.0.4 to before 3.4.0 Fixed in 3.4.0 Patch available GHSA-4p24-vmcr-4gqj
  • org.webjars:bootstrap (Maven) Vendor— Affected 4.0.0-beta to before 4.0.0-beta.2 Fixed in 4.0.0-beta.2 Patch available GHSA-4p24-vmcr-4gqj
  • bootstrap (RubyGems) Vendor— Affected before 4.0.0-beta.2 Fixed in 4.0.0-beta.2 Patch available GHSA-4p24-vmcr-4gqj
  • twbs/bootstrap (Packagist) Vendor— Affected 2.0.4 to before 3.4.0 Fixed in 3.4.0 Patch available GHSA-4p24-vmcr-4gqj
  • twbs/bootstrap (Packagist) Vendor— Affected 4.0.0-beta to before 4.0.0-beta.2 Fixed in 4.0.0-beta.2 Patch available GHSA-4p24-vmcr-4gqj
  • bootstrap (NuGet) Vendor— Affected 2.0.4 to before 3.4.0 Fixed in 3.4.0 Patch available GHSA-4p24-vmcr-4gqj
  • bootstrap (NuGet) Vendor— Affected 4.0.0-beta to before 4.0.0-beta.2 Fixed in 4.0.0-beta.2 Patch available GHSA-4p24-vmcr-4gqj
  • bootstrap-sass (npm) Vendor— Affected 2.0.4 to before 3.4.0 Fixed in 3.4.0 Patch available GHSA-4p24-vmcr-4gqj
  • bootstrap-sass (RubyGems) Vendor— Affected 2.0.4 to before 3.4.0 Fixed in 3.4.0 Patch available GHSA-4p24-vmcr-4gqj
  • bootstrap.sass (NuGet) Vendor— Affected 4.0.0-beta to before 4.0.0-beta.2 Fixed in 4.0.0-beta.2 Patch available GHSA-4p24-vmcr-4gqj

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*3.0.0 to before 3.4.0VulnerableGetbootstrap
cpe:2.3:a:getbootstrap:bootstrap:4.0.0:beta:*:*:*:*:*:*4.0.0 betaVulnerableGetbootstrap
  • cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.4.0 Vulnerable ·Getbootstrap
  • cpe:2.3:a:getbootstrap:bootstrap:4.0.0:beta:*:*:*:*:*:* Versions 4.0.0 beta Vulnerable ·Getbootstrap

Remediation

  • Fix · GHSA-4p24-vmcr-4gqj bootstrap (npm) Fixed in 3.4.0 Advisory →
  • Fix · GHSA-4p24-vmcr-4gqj bootstrap (npm) Fixed in 4.0.0-beta.2 Advisory →
  • Fix · GHSA-4p24-vmcr-4gqj org.webjars:bootstrap (Maven) Fixed in 3.4.0 Advisory →
  • Fix · GHSA-4p24-vmcr-4gqj org.webjars:bootstrap (Maven) Fixed in 4.0.0-beta.2 Advisory →
  • Fix · GHSA-4p24-vmcr-4gqj bootstrap (RubyGems) Fixed in 4.0.0-beta.2 Advisory →
  • Fix · GHSA-4p24-vmcr-4gqj twbs/bootstrap (Packagist) Fixed in 3.4.0 Advisory →
  • Fix · GHSA-4p24-vmcr-4gqj twbs/bootstrap (Packagist) Fixed in 4.0.0-beta.2 Advisory →
  • Fix · GHSA-4p24-vmcr-4gqj bootstrap (NuGet) Fixed in 3.4.0 Advisory →
  • Fix · GHSA-4p24-vmcr-4gqj bootstrap (NuGet) Fixed in 4.0.0-beta.2 Advisory →
  • Fix · GHSA-4p24-vmcr-4gqj bootstrap-sass (npm) Fixed in 3.4.0 Advisory →
  • Fix · GHSA-4p24-vmcr-4gqj bootstrap-sass (RubyGems) Fixed in 3.4.0 Advisory →
  • Fix · GHSA-4p24-vmcr-4gqj bootstrap.sass (NuGet) Fixed in 4.0.0-beta.2 Advisory →

Red Hat 12 advisories

  • RHSA-2023:0556 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss Enterprise Application Platform 7.4.9 com.fasterxml.jackson.core.jackson-databind-2.12.7.redhat-00003.jar, com.fasterxml.woodstox.woodstox-core-6.4.0.redhat-00001.jar, org.apache.cxf.cxf-core-3.4.10.redhat-00001.jar +4
  • RHSA-2023:0554 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-apache-sshd-2.9.2-1.redhat_00001.1.el9eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el9eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el9eap +44
  • RHSA-2023:0552 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-sshd-2.9.2-1.redhat_00001.1.el7eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el7eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el7eap +46
Show 9 more Red Hat advisories
  • RHSA-2023:0553 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-sshd-2.9.2-1.redhat_00001.1.el8eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el8eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el8eap +44
  • RHSA-2020:5571 Released 2020-12-16 · Red Hat rating Moderate
    python-XStatic-Bootstrap-SCSS security update
    • Red Hat OpenStack Platform 13.0 python-XStatic-Bootstrap-SCSS-3.4.1.0-1.el7ost, xstatic-bootstrap-scss-common-3.4.1.0-1.el7ost
    • Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server python-XStatic-Bootstrap-SCSS-3.4.1.0-1.el7ost, xstatic-bootstrap-scss-common-3.4.1.0-1.el7ost
  • RHSA-2020:4847 Released 2020-11-04 · Red Hat rating Moderate
    pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
  • RHSA-2020:4670 Released 2020-11-04 · Red Hat rating Moderate
    idm:DL1 and idm:client security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) bind-dyndb-ldap-11.3-1.module+el8.3.0+6993+104f8db0.aarch64::idm:DL1, bind-dyndb-ldap-11.3-1.module+el8.3.0+6993+104f8db0.ppc64le::idm:DL1, bind-dyndb-ldap-11.3-1.module+el8.3.0+6993+104f8db0.s390x::idm:DL1 +47
  • RHSA-2020:3936 Released 2020-09-29 · Red Hat rating Moderate
    ipa security, bug fix, and enhancement update
    • Red Hat Enterprise Linux Client (v. 7) ipa-4.6.8-5.el7, ipa-client-4.6.8-5.el7, ipa-client-common-4.6.8-5.el7 +4
    • Red Hat Enterprise Linux Client Optional (v. 7) ipa-server-4.6.8-5.el7, ipa-server-common-4.6.8-5.el7, ipa-server-dns-4.6.8-5.el7 +2
    • Red Hat Enterprise Linux ComputeNode (v. 7) ipa-4.6.8-5.el7, ipa-client-4.6.8-5.el7, ipa-client-common-4.6.8-5.el7 +4
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) ipa-server-4.6.8-5.el7, ipa-server-common-4.6.8-5.el7, ipa-server-dns-4.6.8-5.el7 +2
    • Red Hat Enterprise Linux Server (v. 7) ipa-4.6.8-5.el7, ipa-client-4.6.8-5.el7, ipa-client-common-4.6.8-5.el7 +9
    • Red Hat Enterprise Linux Workstation (v. 7) ipa-4.6.8-5.el7, ipa-client-4.6.8-5.el7, ipa-client-common-4.6.8-5.el7 +9
  • RHSA-2020:0133 Released 2020-01-16 · Red Hat rating Moderate
    Red Hat Decision Manager 7.6.0 Security Update
    • Red Hat Decision Manager 7
  • RHSA-2020:0132 Released 2020-01-16 · Red Hat rating Moderate
    Red Hat Process Automation Manager 7.6.0 Security Update
    • Red Hat Process Automation 7
  • RHSA-2019:3023 Released 2019-10-10 · Red Hat rating Moderate
    ovirt-engine-ui-extensions security and bug fix update
    • RHV-M 4.3 ovirt-engine-ui-extensions-1.0.10-1.el7ev
  • RHSA-2019:1456 Released 2019-06-11 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.3.2 security update
    • Red Hat Single Sign-On 7.3.2 zip

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Web Server 2AffectedNo fix yet
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix yet
Red Hat OpenStack Platform 14 (Rocky)AffectedNo fix yet
Red Hat OpenStack Platform 15 (Stein)AffectedNo fix yet
Red Hat OpenStack Platform 8 (Liberty)AffectedNo fix yet
Red Hat OpenStack Platform 9 (Mitaka)AffectedNo fix yet
Red Hat Satellite 5AffectedNo fix planned: Will not fix
Red Hat Virtualization 4AffectedNo fix planned: Out of support scope
CloudForms Management Engine 5.11Fixed—
RHV-M 4.3Fixed RHSA-2019:3023
Red Hat Decision Manager 7Fixed RHSA-2020:0133
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:4670, RHSA-2020:4847
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2020:3936
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2020:3936
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2020:3936
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2020:3936
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:3936
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:3936
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2023:0552
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2023:0553
Red Hat JBoss EAP 7.4 for RHEL 9Fixed RHSA-2023:0554
Red Hat JBoss Enterprise Application Platform 7.4.9Fixed RHSA-2023:0556
Red Hat OpenStack Platform 13.0Fixed RHSA-2020:5571
Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS ServerFixed RHSA-2020:5571
Red Hat Process Automation 7Fixed RHSA-2020:0132
Red Hat Single Sign-On 7.3.2 zipFixed RHSA-2019:1456
Not affected: 5 products
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss EAP 7.4 for RHEL 9
  • Red Hat JBoss Enterprise Application Platform 7.4.9
  • Red Hat Quay 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-10735
  2. 2026-10-03 Alias added: GHSA-4p24-vmcr-4gqj

References

Exploit 1

Patch 1

Advisory 11

Other 7

  • TI-2019-05979 In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute. CVSS 3.1MEDIUM 6.1
  • TI-2018-14682 In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property. CVSS 3.0MEDIUM 6.1
  • TI-2018-14681 In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute. CVSS 3.0MEDIUM 6.1
  • TI-2018-10147 In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip. CVSS 3.0MEDIUM 6.1
  • TI-2018-10146 In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy. CVSS 3.0MEDIUM 6.1
  • TI-2018-10145 In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute. CVSS 3.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences