Read the docs
TI-2024-06015 Aliases CVE-2024-6485GHSA-vxmc-5x29-h64v

XSS in Bootstrap button component

Priority MEDIUM 62CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · Low · Low
Fix status
Partial Red Hat: 1 fixed, 13 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00494 42nd percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 13 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BootstrapBootstrap1.4.0 – 3.4.1—No fix listedCNA
Bootstrap-sassbootstrap-sass2.3.2 – 3.4.3—No fix listedCNA
—bootstrap (npm)1.4.0 – 3.4.1—No fix listedGHSA-vxmc-5x29-h64v
  • Bootstrap VendorBootstrap Affected 1.4.0 – 3.4.1 Fixed in — No fix listed CNA
  • bootstrap-sass VendorBootstrap-sass Affected 2.3.2 – 3.4.3 Fixed in — No fix listed CNA
  • bootstrap (npm) Vendor— Affected 1.4.0 – 3.4.1 Fixed in — No fix listed GHSA-vxmc-5x29-h64v

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*——Getbootstrap
  • cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:* Versions — — ·Getbootstrap

Remediation

Red Hat 1 advisory

  • RHSA-2025:1249 Released 2025-02-10 · Red Hat rating Important
    updated discovery container images
    • Discovery 1 for RHEL 9 discovery/discovery-server-rhel9, discovery/discovery-ui-rhel9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AMQ Broker 7AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 4AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 5AffectedNo fix planned: Out of support scope
Red Hat Certification for Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 16.2AffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat Single Sign-On 7AffectedNo fix planned: Out of support scope
Discovery 1 for RHEL 9Fixed RHSA-2025:1249
Not affected: 10 products
  • Red Hat Build of Keycloak
  • Red Hat Ceph Storage 6
  • Red Hat Ceph Storage 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Quay 3
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-6485
  2. 2026-10-03 Alias added: GHSA-vxmc-5x29-h64v

References

Advisory 1

Other 3

  • TI-2025-01415 XSS in Bootstrap title attribute for Tooltip and Popover CVSS 3.1MEDIUM 5.6
  • TI-2026-06598 Bootstrap CMS Page Creation show.blade.php code injection CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences