Read the docs
TI-2018-10147 Aliases CVE-2018-14042GHSA-7mvr-5x2g-wfc8

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

Priority LOW 34CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 18 fixed, 10 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

Why it matters now

EPSS 0.04009 90th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial bootstrap (RubyGems): 4.1.2, 3.4.0bootstrap (npm): 4.1.2, 3.4.0+6 more productsRed Hat: 13 advisoriesRed Hat: 18 fixed, 10 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—bootstrap (RubyGems)4.0.0 to before 4.1.24.1.2Patch availableGHSA-7mvr-5x2g-wfc8
—bootstrap (RubyGems)2.3.0 to before 3.4.03.4.0Patch availableGHSA-7mvr-5x2g-wfc8
—bootstrap (npm)4.0.0 to before 4.1.24.1.2Patch availableGHSA-7mvr-5x2g-wfc8
—bootstrap (npm)2.3.0 to before 3.4.03.4.0Patch availableGHSA-7mvr-5x2g-wfc8
—org.webjars:bootstrap (Maven)4.0.0 to before 4.1.24.1.2Patch availableGHSA-7mvr-5x2g-wfc8
—org.webjars:bootstrap (Maven)2.3.0 to before 3.4.03.4.0Patch availableGHSA-7mvr-5x2g-wfc8
—twbs/bootstrap (Packagist)4.0.0 to before 4.1.24.1.2Patch availableGHSA-7mvr-5x2g-wfc8
—twbs/bootstrap (Packagist)2.3.0 to before 3.4.03.4.0Patch availableGHSA-7mvr-5x2g-wfc8
—bootstrap (NuGet)4.0.0 to before 4.1.24.1.2Patch availableGHSA-7mvr-5x2g-wfc8
—bootstrap (NuGet)2.3.0 to before 3.4.03.4.0Patch availableGHSA-7mvr-5x2g-wfc8
—bootstrap-sass (RubyGems)2.3.0 to before 3.4.03.4.0Patch availableGHSA-7mvr-5x2g-wfc8
—bootstrap-sass (npm)2.0.4 to before 3.4.03.4.0Patch availableGHSA-7mvr-5x2g-wfc8
—bootstrap.sass (NuGet)4.0.0 to before 4.1.24.1.2Patch availableGHSA-7mvr-5x2g-wfc8
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • bootstrap (RubyGems) Vendor— Affected 4.0.0 to before 4.1.2 Fixed in 4.1.2 Patch available GHSA-7mvr-5x2g-wfc8
  • bootstrap (RubyGems) Vendor— Affected 2.3.0 to before 3.4.0 Fixed in 3.4.0 Patch available GHSA-7mvr-5x2g-wfc8
  • bootstrap (npm) Vendor— Affected 4.0.0 to before 4.1.2 Fixed in 4.1.2 Patch available GHSA-7mvr-5x2g-wfc8
  • bootstrap (npm) Vendor— Affected 2.3.0 to before 3.4.0 Fixed in 3.4.0 Patch available GHSA-7mvr-5x2g-wfc8
  • org.webjars:bootstrap (Maven) Vendor— Affected 4.0.0 to before 4.1.2 Fixed in 4.1.2 Patch available GHSA-7mvr-5x2g-wfc8
  • org.webjars:bootstrap (Maven) Vendor— Affected 2.3.0 to before 3.4.0 Fixed in 3.4.0 Patch available GHSA-7mvr-5x2g-wfc8
  • twbs/bootstrap (Packagist) Vendor— Affected 4.0.0 to before 4.1.2 Fixed in 4.1.2 Patch available GHSA-7mvr-5x2g-wfc8
  • twbs/bootstrap (Packagist) Vendor— Affected 2.3.0 to before 3.4.0 Fixed in 3.4.0 Patch available GHSA-7mvr-5x2g-wfc8
  • bootstrap (NuGet) Vendor— Affected 4.0.0 to before 4.1.2 Fixed in 4.1.2 Patch available GHSA-7mvr-5x2g-wfc8
  • bootstrap (NuGet) Vendor— Affected 2.3.0 to before 3.4.0 Fixed in 3.4.0 Patch available GHSA-7mvr-5x2g-wfc8
  • bootstrap-sass (RubyGems) Vendor— Affected 2.3.0 to before 3.4.0 Fixed in 3.4.0 Patch available GHSA-7mvr-5x2g-wfc8
  • bootstrap-sass (npm) Vendor— Affected 2.0.4 to before 3.4.0 Fixed in 3.4.0 Patch available GHSA-7mvr-5x2g-wfc8
  • bootstrap.sass (NuGet) Vendor— Affected 4.0.0 to before 4.1.2 Fixed in 4.1.2 Patch available GHSA-7mvr-5x2g-wfc8

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*before 3.4.0; 4.0.0 to before 4.1.2VulnerableGetbootstrap
cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha:*:*:*:*:*:*4.0.0 alphaVulnerableGetbootstrap
cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha2:*:*:*:*:*:*4.0.0 alpha2VulnerableGetbootstrap
cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha3:*:*:*:*:*:*4.0.0 alpha3VulnerableGetbootstrap
cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha4:*:*:*:*:*:*4.0.0 alpha4VulnerableGetbootstrap
cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha5:*:*:*:*:*:*4.0.0 alpha5VulnerableGetbootstrap
cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha6:*:*:*:*:*:*4.0.0 alpha6VulnerableGetbootstrap
cpe:2.3:a:getbootstrap:bootstrap:4.0.0:beta:*:*:*:*:*:*4.0.0 betaVulnerableGetbootstrap
cpe:2.3:a:getbootstrap:bootstrap:4.0.0:beta2:*:*:*:*:*:*4.0.0 beta2VulnerableGetbootstrap
cpe:2.3:a:getbootstrap:bootstrap:4.0.0:beta3:*:*:*:*:*:*4.0.0 beta3VulnerableGetbootstrap
  • cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:* Versions before 3.4.0; 4.0.0 to before 4.1.2 Vulnerable ·Getbootstrap
  • cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha:*:*:*:*:*:* Versions 4.0.0 alpha Vulnerable ·Getbootstrap
  • cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha2:*:*:*:*:*:* Versions 4.0.0 alpha2 Vulnerable ·Getbootstrap
  • cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha3:*:*:*:*:*:* Versions 4.0.0 alpha3 Vulnerable ·Getbootstrap
  • cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha4:*:*:*:*:*:* Versions 4.0.0 alpha4 Vulnerable ·Getbootstrap
  • cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha5:*:*:*:*:*:* Versions 4.0.0 alpha5 Vulnerable ·Getbootstrap
  • cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha6:*:*:*:*:*:* Versions 4.0.0 alpha6 Vulnerable ·Getbootstrap
  • cpe:2.3:a:getbootstrap:bootstrap:4.0.0:beta:*:*:*:*:*:* Versions 4.0.0 beta Vulnerable ·Getbootstrap
  • cpe:2.3:a:getbootstrap:bootstrap:4.0.0:beta2:*:*:*:*:*:* Versions 4.0.0 beta2 Vulnerable ·Getbootstrap
  • cpe:2.3:a:getbootstrap:bootstrap:4.0.0:beta3:*:*:*:*:*:* Versions 4.0.0 beta3 Vulnerable ·Getbootstrap

Remediation

  • Fix · GHSA-7mvr-5x2g-wfc8 bootstrap (RubyGems) Fixed in 4.1.2 Advisory →
  • Fix · GHSA-7mvr-5x2g-wfc8 bootstrap (RubyGems) Fixed in 3.4.0 Advisory →
  • Fix · GHSA-7mvr-5x2g-wfc8 bootstrap (npm) Fixed in 4.1.2 Advisory →
  • Fix · GHSA-7mvr-5x2g-wfc8 bootstrap (npm) Fixed in 3.4.0 Advisory →
  • Fix · GHSA-7mvr-5x2g-wfc8 org.webjars:bootstrap (Maven) Fixed in 4.1.2 Advisory →
  • Fix · GHSA-7mvr-5x2g-wfc8 org.webjars:bootstrap (Maven) Fixed in 3.4.0 Advisory →
  • Fix · GHSA-7mvr-5x2g-wfc8 twbs/bootstrap (Packagist) Fixed in 4.1.2 Advisory →
  • Fix · GHSA-7mvr-5x2g-wfc8 twbs/bootstrap (Packagist) Fixed in 3.4.0 Advisory →
  • Fix · GHSA-7mvr-5x2g-wfc8 bootstrap (NuGet) Fixed in 4.1.2 Advisory →
  • Fix · GHSA-7mvr-5x2g-wfc8 bootstrap (NuGet) Fixed in 3.4.0 Advisory →
  • Fix · GHSA-7mvr-5x2g-wfc8 bootstrap-sass (RubyGems) Fixed in 3.4.0 Advisory →
  • Fix · GHSA-7mvr-5x2g-wfc8 bootstrap-sass (npm) Fixed in 3.4.0 Advisory →
  • Fix · GHSA-7mvr-5x2g-wfc8 bootstrap.sass (NuGet) Fixed in 4.1.2 Advisory →

Red Hat 13 advisories

  • RHSA-2023:1043 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 7
    • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el7sso
  • RHSA-2023:1049 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update
    • Red Hat Single Sign-On 7
  • RHSA-2023:1047 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 for OpenShift image security and enhancement update
    • Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
Show 10 more Red Hat advisories
  • RHSA-2023:1045 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 9
    • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el9sso
  • RHSA-2023:1044 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 8
    • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el8sso
  • RHSA-2023:0556 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss Enterprise Application Platform 7.4.9 com.fasterxml.jackson.core.jackson-databind-2.12.7.redhat-00003.jar, com.fasterxml.woodstox.woodstox-core-6.4.0.redhat-00001.jar, org.apache.cxf.cxf-core-3.4.10.redhat-00001.jar +4
  • RHSA-2023:0554 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-apache-sshd-2.9.2-1.redhat_00001.1.el9eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el9eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el9eap +44
  • RHSA-2023:0552 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-sshd-2.9.2-1.redhat_00001.1.el7eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el7eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el7eap +46
  • RHSA-2023:0553 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-sshd-2.9.2-1.redhat_00001.1.el8eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el8eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el8eap +44
  • RHSA-2020:5571 Released 2020-12-16 · Red Hat rating Moderate
    python-XStatic-Bootstrap-SCSS security update
    • Red Hat OpenStack Platform 13.0 python-XStatic-Bootstrap-SCSS-3.4.1.0-1.el7ost, xstatic-bootstrap-scss-common-3.4.1.0-1.el7ost
    • Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server python-XStatic-Bootstrap-SCSS-3.4.1.0-1.el7ost, xstatic-bootstrap-scss-common-3.4.1.0-1.el7ost
  • RHSA-2020:4847 Released 2020-11-04 · Red Hat rating Moderate
    pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
  • RHSA-2020:4670 Released 2020-11-04 · Red Hat rating Moderate
    idm:DL1 and idm:client security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) bind-dyndb-ldap-11.3-1.module+el8.3.0+6993+104f8db0.aarch64::idm:DL1, bind-dyndb-ldap-11.3-1.module+el8.3.0+6993+104f8db0.ppc64le::idm:DL1, bind-dyndb-ldap-11.3-1.module+el8.3.0+6993+104f8db0.s390x::idm:DL1 +47
  • RHSA-2020:3936 Released 2020-09-29 · Red Hat rating Moderate
    ipa security, bug fix, and enhancement update
    • Red Hat Enterprise Linux Client (v. 7) ipa-4.6.8-5.el7, ipa-client-4.6.8-5.el7, ipa-client-common-4.6.8-5.el7 +4
    • Red Hat Enterprise Linux Client Optional (v. 7) ipa-server-4.6.8-5.el7, ipa-server-common-4.6.8-5.el7, ipa-server-dns-4.6.8-5.el7 +2
    • Red Hat Enterprise Linux ComputeNode (v. 7) ipa-4.6.8-5.el7, ipa-client-4.6.8-5.el7, ipa-client-common-4.6.8-5.el7 +4
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) ipa-server-4.6.8-5.el7, ipa-server-common-4.6.8-5.el7, ipa-server-dns-4.6.8-5.el7 +2
    • Red Hat Enterprise Linux Server (v. 7) ipa-4.6.8-5.el7, ipa-client-4.6.8-5.el7, ipa-client-common-4.6.8-5.el7 +9
    • Red Hat Enterprise Linux Workstation (v. 7) ipa-4.6.8-5.el7, ipa-client-4.6.8-5.el7, ipa-client-common-4.6.8-5.el7 +9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Decision Manager 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 12 (Pike)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 14 (Rocky)AffectedNo fix yet
Red Hat OpenStack Platform 8 (Liberty)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 9 (Mitaka)AffectedNo fix planned: Will not fix
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat Satellite 5AffectedNo fix planned: Will not fix
Red Hat Virtualization 4AffectedNo fix planned: Will not fix
Middleware Containers for OpenShiftFixed RHSA-2023:1047
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:4670, RHSA-2020:4847
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2020:3936
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2020:3936
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2020:3936
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2020:3936
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:3936
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:3936
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2023:0552
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2023:0553
Red Hat JBoss EAP 7.4 for RHEL 9Fixed RHSA-2023:0554
Red Hat JBoss Enterprise Application Platform 7.4.9Fixed RHSA-2023:0556
Red Hat OpenStack Platform 13.0Fixed RHSA-2020:5571
Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS ServerFixed RHSA-2020:5571
Red Hat Single Sign-On 7Fixed RHSA-2023:1049
Red Hat Single Sign-On 7.6 for RHEL 7 ServerFixed RHSA-2023:1043
Red Hat Single Sign-On 7.6 for RHEL 8Fixed RHSA-2023:1044
Red Hat Single Sign-On 7.6 for RHEL 9Fixed RHSA-2023:1045
Not affected: 7 products
  • CloudForms Management Engine 5
  • Red Hat 3scale API Management Platform 2
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss EAP 7.4 for RHEL 9
  • Red Hat JBoss Enterprise Application Platform 7.4.9
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-14042
  2. 2026-10-03 Alias added: GHSA-7mvr-5x2g-wfc8

References

Exploit 1

Patch 1

Advisory 4

Other 26

  • TI-2019-05979 In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute. CVSS 3.1MEDIUM 6.1
  • TI-2018-14682 In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property. CVSS 3.0MEDIUM 6.1
  • TI-2018-14681 In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute. CVSS 3.0MEDIUM 6.1
  • TI-2018-10146 In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy. CVSS 3.0MEDIUM 6.1
  • TI-2018-10145 In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute. CVSS 3.0MEDIUM 6.1
  • TI-2016-08775 In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the… CVSS 3.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences