Open mend-for-github-com[bot] opened 1 year ago
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
CVE-2019-8331 - Medium Severity Vulnerability
bootstrap-4.1.2.jar
WebJar for Bootstrap
Library home page: http://webjars.org
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/webjars/bootstrap/4.1.2/bootstrap-4.1.2.jar
Dependency Hierarchy: - :x: **bootstrap-4.1.2.jar** (Vulnerable Library)
bootstrap-3.1.1.min.js
The most popular front-end framework for developing responsive, mobile first projects on the web.
Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.1.1/js/bootstrap.min.js
Path to vulnerable library: /src/main/resources/webgoat/static/js/libs/bootstrap.min.js,/src/main/resources/lessons/challenges/js/bootstrap.min.js
Dependency Hierarchy: - :x: **bootstrap-3.1.1.min.js** (Vulnerable Library)
Found in HEAD commit: d03a502abaded7d0a347a89d38abf1339e8218da
Found in base branch: develop
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
Publish Date: 2019-02-20
URL: CVE-2019-8331
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Release Date: 2019-02-20
Fix Resolution: 4.3.1