01 Record

CVE-2016-10735

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

UnratedPUBLISHEDCNA: mitre

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 4.04% probability of exploitation activity in the next 30 days.
EPSS percentile: Ranks above 89.9% of scored records. A rank, not a probability.
NVD base score: 6.1 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2019-01-09 05:00Z7 YR AGO

Last updated

2024-08-06 03:30Z2 YR AGO

Reserved

2019-01-08

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Base

Data version

5.1

Document digest

1e6bf61670189beba7ed6b44c3adfd60158541af4257619e3f45cd81f275137a

05 Affected products

VendorProductVersionsPlatforms

getbootstrapbootstrapNot specified—

redhatcloudforms_managementengineNot specified—

redhatenterprise_linuxNot specified—

redhatjboss_enterprise_application_platformNot specified—

redhatjboss_enterprise_bpms_platformNot specified—

redhatjboss_enterprise_brms_platformNot specified—

redhatjboss_enterprise_web_serverNot specified—

redhatjboss_single_sign_onNot specified—

redhatnetwork_satelliteNot specified—

redhatopenstackNot specified—

redhatquayNot specified—

redhatrhev_hypervisorNot specified—

redhatrhev_managerNot specified—

06 References

github.comhttps://github.com/twbs/bootstrap/issues/27915#issuecomment-452140906x_refsource_MISC
github.comhttps://github.com/twbs/bootstrap/pull/26460x_refsource_MISC
github.comhttps://github.com/twbs/bootstrap/issues/20184x_refsource_MISC
github.comhttps://github.com/twbs/bootstrap/pull/23687x_refsource_MISC
github.comhttps://github.com/twbs/bootstrap/pull/23679x_refsource_MISC
blog.getbootstrap.comhttps://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/x_refsource_MISC
access.redhat.comRHSA-2019:1456https://access.redhat.com/errata/RHSA-2019:1456vendor-advisoryx_refsource_REDHAT
access.redhat.comRHBA-2019:1076https://access.redhat.com/errata/RHBA-2019:1076vendor-advisoryx_refsource_REDHAT
access.redhat.comRHBA-2019:1570https://access.redhat.com/errata/RHBA-2019:1570vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:3023https://access.redhat.com/errata/RHSA-2019:3023vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2020:0132https://access.redhat.com/errata/RHSA-2020:0132vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2020:0133https://access.redhat.com/errata/RHSA-2020:0133vendor-advisoryx_refsource_REDHAT
www.tenable.comhttps://www.tenable.com/security/tns-2021-14x_refsource_CONFIRM

01 Record index

CVE-2016-10735

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2016-10735

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References