CVE-2018-14041 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	6.1 MEDIUM	NETWORK	LOW	NONE	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
mitre	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 90%

Vendor	Product	Version
getbootstrap	bootstrap	4.0.0 ≤ 𝑥 < 4.1.2
getbootstrap	bootstrap	4.0.0:alpha
getbootstrap	bootstrap	4.0.0:alpha2
getbootstrap	bootstrap	4.0.0:alpha3
getbootstrap	bootstrap	4.0.0:alpha4
getbootstrap	bootstrap	4.0.0:alpha5
getbootstrap	bootstrap	4.0.0:alpha6
getbootstrap	bootstrap	4.0.0:beta
getbootstrap	bootstrap	4.0.0:beta2
getbootstrap	bootstrap	4.0.0:beta3

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

twitter-bootstrap3

bullseye	3.4.1+dfsg-2 fixed
sid	3.4.1+dfsg-3 fixed
trixie	3.4.1+dfsg-3 fixed
bookworm	3.4.1+dfsg-3 fixed

Ubuntu Releases

Ubuntu Product

Codename

twitter-bootstrap

disco	not-affected
cosmic	not-affected
bionic	not-affected
artful	ignored
xenial	not-affected
trusty	dne

twitter-bootstrap3

disco	not-affected
cosmic	not-affected
bionic	not-affected
artful	ignored
xenial	not-affected
trusty	dne

Known Exploits!

Common Weakness Enumeration

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References

http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html

http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html

http://seclists.org/fulldisclosure/2019/May/10

http://seclists.org/fulldisclosure/2019/May/11

http://seclists.org/fulldisclosure/2019/May/13

https://access.redhat.com/errata/RHSA-2019:1456

https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/

https://github.com/twbs/bootstrap/issues/26423

https://github.com/twbs/bootstrap/issues/26627

https://github.com/twbs/bootstrap/pull/26630

https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E

https://lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e%40%3Cdev.superset.apache.org%3E

https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E

https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E

https://lists.apache.org/thread.html/r3dc0cac8d856bca02bd6997355d7ff83027dcfc82f8646a29b89b714%40%3Cissues.hbase.apache.org%3E

https://seclists.org/bugtraq/2019/May/18

https://www.oracle.com/security-alerts/cpuApr2021.html

http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html

http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html

http://seclists.org/fulldisclosure/2019/May/10

http://seclists.org/fulldisclosure/2019/May/11

http://seclists.org/fulldisclosure/2019/May/13

https://access.redhat.com/errata/RHSA-2019:1456

https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/

https://github.com/twbs/bootstrap/issues/26423

https://github.com/twbs/bootstrap/issues/26627

https://github.com/twbs/bootstrap/pull/26630

https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E

https://lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e%40%3Cdev.superset.apache.org%3E

https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E

https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E

https://lists.apache.org/thread.html/r3dc0cac8d856bca02bd6997355d7ff83027dcfc82f8646a29b89b714%40%3Cissues.hbase.apache.org%3E

https://seclists.org/bugtraq/2019/May/18

https://www.oracle.com/security-alerts/cpuApr2021.html