CVE-2016-10735: XSS

Published Jun 27, 2016
·
Updated

Bootstrap is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the data-target attribute. A remote attacker could exploit this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

Other sources

In Bootstrap 2.x from 2.0.4, 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute. Note that this is a different vulnerability than CVE-2018-14041.

See https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/ for more info.

— GitHub

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

Affected Software

76 affected componentsFixes available
redhat/ansible-runner<0:1.3.4-2.el8a
0:1.3.4-2.el8a
redhat/ansible-tower<0:3.5.2-1.el8a
0:3.5.2-1.el8a
redhat/cfme<0:5.11.0.28-1.el8cf
0:5.11.0.28-1.el8cf
redhat/cfme-amazon-smartstate<0:5.11.0.28-1.el8cf
0:5.11.0.28-1.el8cf
redhat/cfme-appliance<0:5.11.0.28-1.el8cf
0:5.11.0.28-1.el8cf
redhat/cfme-gemset<0:5.11.0.28-1.el8cf
0:5.11.0.28-1.el8cf
redhat/ovirt-ansible-cluster-upgrade<0:1.1.13-1.el8e
0:1.1.13-1.el8e
redhat/ovirt-ansible-disaster-recovery<0:1.2.0-1.el8e
0:1.2.0-1.el8e
redhat/ovirt-ansible-engine-setup<0:1.1.9-1.el8e
0:1.1.9-1.el8e
redhat/ovirt-ansible-hosted-engine-setup<0:1.0.26-1.el8e
0:1.0.26-1.el8e
redhat/ovirt-ansible-image-template<0:1.1.11-1.el8e
0:1.1.11-1.el8e
redhat/ovirt-ansible-infra<0:1.1.12-1.el8e
0:1.1.12-1.el8e
redhat/ovirt-ansible-manageiq<0:1.1.14-1.el8e
0:1.1.14-1.el8e
redhat/ovirt-ansible-repositories<0:1.1.5-1.el8e
0:1.1.5-1.el8e
redhat/ovirt-ansible-roles<0:1.1.7-2.el8e
0:1.1.7-2.el8e
redhat/ovirt-ansible-shutdown-env<0:1.0.3-1.el8e
0:1.0.3-1.el8e
redhat/ovirt-ansible-vm-infra<0:1.1.19-1.el8e
0:1.1.19-1.el8e
redhat/prince<0:12.4-1.el8cf
0:12.4-1.el8cf
redhat/python3-ovirt-engine-sdk4<0:4.3.2-1.el8e
0:4.3.2-1.el8e
redhat/python-bambou<0:3.0.1-2.el8cf
0:3.0.1-2.el8cf
redhat/python-colorama<0:0.4.1-1.el8
0:0.4.1-1.el8
redhat/python-daemon<0:2.1.2-9.el8a
0:2.1.2-9.el8a
redhat/python-funcsigs<0:1.0.2-3.el8
0:1.0.2-3.el8
redhat/python-future<0:0.16.0-1.el8cf
0:0.16.0-1.el8cf
redhat/python-lockfile<1:0.11.0-8.el8a
1:0.11.0-8.el8a
redhat/python-mock<0:2.0.0-11.el8
0:2.0.0-11.el8
redhat/python-pbr<0:5.1.2-2.el8
0:5.1.2-2.el8
redhat/python-pexpect<0:4.6-2.el8a
0:4.6-2.el8a
redhat/python-psutil<0:5.4.3-5.el8a
0:5.4.3-5.el8a
redhat/python-pylxca<0:2.1.1-2.el8cf
0:2.1.1-2.el8cf
redhat/python-requests-toolbelt<0:0.8.0-2.el8cf
0:0.8.0-2.el8cf
redhat/python-tabulate<0:0.8.2-1.el8cf
0:0.8.2-1.el8cf
redhat/python-vspk<0:5.3.2-2.el8cf
0:5.3.2-2.el8cf
redhat/qpid-proton<0:0.28.0-1.el8
0:0.28.0-1.el8
redhat/repmgr10<0:4.0.6-3.el8cf
0:4.0.6-3.el8cf
redhat/rubygem-bcrypt<0:3.1.13-1.el8cf
0:3.1.13-1.el8cf
redhat/rubygem-byebug<0:11.0.1-1.el8cf
0:11.0.1-1.el8cf
redhat/rubygem-ffi<0:1.9.25-1.el8cf
0:1.9.25-1.el8cf
redhat/rubygem-hamlit<0:2.8.10-1.el8cf
0:2.8.10-1.el8cf
redhat/rubygem-nio4r<0:2.4.0-1.el8cf
0:2.4.0-1.el8cf
redhat/rubygem-nokogiri<0:1.8.5-1.el8cf
0:1.8.5-1.el8cf
redhat/rubygem-ovirt-engine-sdk4<0:4.3.0-1.el8cf
0:4.3.0-1.el8cf
redhat/rubygem-puma<0:3.7.1-1.el8cf
0:3.7.1-1.el8cf
redhat/rubygem-rugged<0:0.28.2-1.el8cf
0:0.28.2-1.el8cf
redhat/rubygem-sassc<0:2.0.1-1.el8cf
0:2.0.1-1.el8cf
redhat/rubygem-sqlite3<0:1.3.13-2.el8cf
0:1.3.13-2.el8cf
redhat/rubygem-surro-gate<0:1.0.5-1.el8cf
0:1.0.5-1.el8cf
redhat/rubygem-websocket-driver<0:0.6.5-1.el8cf
0:0.6.5-1.el8cf
redhat/smem<0:1.4-1.el8cf
0:1.4-1.el8cf
redhat/v2v-conversion-host<0:1.14.2-1.el8e
0:1.14.2-1.el8e
redhat/wmi<0:1.3.14-8.el8cf
0:1.3.14-8.el8cf
redhat/ipa<0:4.6.8-5.el7
0:4.6.8-5.el7
redhat/eap7-hal-console<0:3.3.16-1.Final_redhat_00001.1.el8ea
0:3.3.16-1.Final_redhat_00001.1.el8ea
redhat/eap7-hal-console<0:3.3.16-1.Final_redhat_00001.1.el9ea
0:3.3.16-1.Final_redhat_00001.1.el9ea
redhat/eap7-hal-console<0:3.3.16-1.Final_redhat_00001.1.el7ea
0:3.3.16-1.Final_redhat_00001.1.el7ea
redhat/ovirt-engine-api-explorer<0:0.0.4-1.el7e
0:0.0.4-1.el7e
redhat/ovirt-engine-api-explorer<0:0.0.5-1.el7e
0:0.0.5-1.el7e
redhat/ovirt-engine-ui-extensions<0:1.0.10-1.el7e
0:1.0.10-1.el7e
redhat/bootstrap<3.4.0
3.4.0
redhat/bootstrap<4.0.0
4.0.0
nuget/bootstrap.sass>=4.0.0-beta<4.0.0-beta.2
4.0.0-beta.2
rubygems/bootstrap-sass>=2.0.4<3.4.0
3.4.0
npm/bootstrap-sass>=2.0.4<3.4.0
3.4.0
nuget/bootstrap>=4.0.0-beta<4.0.0-beta.2
4.0.0-beta.2
nuget/bootstrap>=2.0.4<3.4.0
3.4.0
composer/twbs/bootstrap>=4.0.0-beta<4.0.0-beta.2
4.0.0-beta.2
composer/twbs/bootstrap>=2.0.4<3.4.0
3.4.0
rubygems/bootstrap<4.0.0-beta.2
4.0.0-beta.2
maven/org.webjars:bootstrap>=4.0.0-beta<4.0.0-beta.2
4.0.0-beta.2
maven/org.webjars:bootstrap>=2.0.4<3.4.0
3.4.0
npm/bootstrap>=2.0.4<3.4.0
3.4.0
npm/bootstrap>=4.0.0-beta<4.0.0-beta.2
4.0.0-beta.2
IBM Cognos Analytics<=12.0.0-12.0.3
IBM Cognos Analytics<=11.2.0-11.2.4 FP4
getbootstrap Bootstrap>=3.0.0<3.4.0
getbootstrap Bootstrap=4.0.0-beta

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/ansible-runner to a version that resolves this vulnerability.

    Fixed in 0:1.3.4-2.el8a
  2. Upgrade

    Upgrade redhat/ansible-tower to a version that resolves this vulnerability.

    Fixed in 0:3.5.2-1.el8a
  3. Upgrade

    Upgrade redhat/cfme to a version that resolves this vulnerability.

    Fixed in 0:5.11.0.28-1.el8cf
  4. Upgrade

    Upgrade redhat/cfme-amazon-smartstate to a version that resolves this vulnerability.

    Fixed in 0:5.11.0.28-1.el8cf
  5. Upgrade

    Upgrade redhat/cfme-appliance to a version that resolves this vulnerability.

    Fixed in 0:5.11.0.28-1.el8cf
  6. Upgrade

    Upgrade redhat/cfme-gemset to a version that resolves this vulnerability.

    Fixed in 0:5.11.0.28-1.el8cf
  7. Upgrade

    Upgrade redhat/ovirt-ansible-cluster-upgrade to a version that resolves this vulnerability.

    Fixed in 0:1.1.13-1.el8e
  8. Upgrade

    Upgrade redhat/ovirt-ansible-disaster-recovery to a version that resolves this vulnerability.

    Fixed in 0:1.2.0-1.el8e
  9. Upgrade

    Upgrade redhat/ovirt-ansible-engine-setup to a version that resolves this vulnerability.

    Fixed in 0:1.1.9-1.el8e
  10. Upgrade

    Upgrade redhat/ovirt-ansible-hosted-engine-setup to a version that resolves this vulnerability.

    Fixed in 0:1.0.26-1.el8e
  11. Upgrade

    Upgrade redhat/ovirt-ansible-image-template to a version that resolves this vulnerability.

    Fixed in 0:1.1.11-1.el8e
  12. Upgrade

    Upgrade redhat/ovirt-ansible-infra to a version that resolves this vulnerability.

    Fixed in 0:1.1.12-1.el8e
  13. Upgrade

    Upgrade redhat/ovirt-ansible-manageiq to a version that resolves this vulnerability.

    Fixed in 0:1.1.14-1.el8e
  14. Upgrade

    Upgrade redhat/ovirt-ansible-repositories to a version that resolves this vulnerability.

    Fixed in 0:1.1.5-1.el8e
  15. Upgrade

    Upgrade redhat/ovirt-ansible-roles to a version that resolves this vulnerability.

    Fixed in 0:1.1.7-2.el8e
  16. Upgrade

    Upgrade redhat/ovirt-ansible-shutdown-env to a version that resolves this vulnerability.

    Fixed in 0:1.0.3-1.el8e
  17. Upgrade

    Upgrade redhat/ovirt-ansible-vm-infra to a version that resolves this vulnerability.

    Fixed in 0:1.1.19-1.el8e
  18. Upgrade

    Upgrade redhat/prince to a version that resolves this vulnerability.

    Fixed in 0:12.4-1.el8cf
  19. Upgrade

    Upgrade redhat/python3-ovirt-engine-sdk4 to a version that resolves this vulnerability.

    Fixed in 0:4.3.2-1.el8e
  20. Upgrade

    Upgrade redhat/python-bambou to a version that resolves this vulnerability.

    Fixed in 0:3.0.1-2.el8cf
  21. Upgrade

    Upgrade redhat/python-colorama to a version that resolves this vulnerability.

    Fixed in 0:0.4.1-1.el8
  22. Upgrade

    Upgrade redhat/python-daemon to a version that resolves this vulnerability.

    Fixed in 0:2.1.2-9.el8a
  23. Upgrade

    Upgrade redhat/python-funcsigs to a version that resolves this vulnerability.

    Fixed in 0:1.0.2-3.el8
  24. Upgrade

    Upgrade redhat/python-future to a version that resolves this vulnerability.

    Fixed in 0:0.16.0-1.el8cf
  25. Upgrade

    Upgrade redhat/python-lockfile to a version that resolves this vulnerability.

    Fixed in 1:0.11.0-8.el8a
  26. Upgrade

    Upgrade redhat/python-mock to a version that resolves this vulnerability.

    Fixed in 0:2.0.0-11.el8
  27. Upgrade

    Upgrade redhat/python-pbr to a version that resolves this vulnerability.

    Fixed in 0:5.1.2-2.el8
  28. Upgrade

    Upgrade redhat/python-pexpect to a version that resolves this vulnerability.

    Fixed in 0:4.6-2.el8a
  29. Upgrade

    Upgrade redhat/python-psutil to a version that resolves this vulnerability.

    Fixed in 0:5.4.3-5.el8a
  30. Upgrade

    Upgrade redhat/python-pylxca to a version that resolves this vulnerability.

    Fixed in 0:2.1.1-2.el8cf
  31. Upgrade

    Upgrade redhat/python-requests-toolbelt to a version that resolves this vulnerability.

    Fixed in 0:0.8.0-2.el8cf
  32. Upgrade

    Upgrade redhat/python-tabulate to a version that resolves this vulnerability.

    Fixed in 0:0.8.2-1.el8cf
  33. Upgrade

    Upgrade redhat/python-vspk to a version that resolves this vulnerability.

    Fixed in 0:5.3.2-2.el8cf
  34. Upgrade

    Upgrade redhat/qpid-proton to a version that resolves this vulnerability.

    Fixed in 0:0.28.0-1.el8
  35. Upgrade

    Upgrade redhat/repmgr10 to a version that resolves this vulnerability.

    Fixed in 0:4.0.6-3.el8cf
  36. Upgrade

    Upgrade redhat/rubygem-bcrypt to a version that resolves this vulnerability.

    Fixed in 0:3.1.13-1.el8cf
  37. Upgrade

    Upgrade redhat/rubygem-byebug to a version that resolves this vulnerability.

    Fixed in 0:11.0.1-1.el8cf
  38. Upgrade

    Upgrade redhat/rubygem-ffi to a version that resolves this vulnerability.

    Fixed in 0:1.9.25-1.el8cf
  39. Upgrade

    Upgrade redhat/rubygem-hamlit to a version that resolves this vulnerability.

    Fixed in 0:2.8.10-1.el8cf
  40. Upgrade

    Upgrade redhat/rubygem-nio4r to a version that resolves this vulnerability.

    Fixed in 0:2.4.0-1.el8cf
  41. Upgrade

    Upgrade redhat/rubygem-nokogiri to a version that resolves this vulnerability.

    Fixed in 0:1.8.5-1.el8cf
  42. Upgrade

    Upgrade redhat/rubygem-ovirt-engine-sdk4 to a version that resolves this vulnerability.

    Fixed in 0:4.3.0-1.el8cf
  43. Upgrade

    Upgrade redhat/rubygem-puma to a version that resolves this vulnerability.

    Fixed in 0:3.7.1-1.el8cf
  44. Upgrade

    Upgrade redhat/rubygem-rugged to a version that resolves this vulnerability.

    Fixed in 0:0.28.2-1.el8cf
  45. Upgrade

    Upgrade redhat/rubygem-sassc to a version that resolves this vulnerability.

    Fixed in 0:2.0.1-1.el8cf
  46. Upgrade

    Upgrade redhat/rubygem-sqlite3 to a version that resolves this vulnerability.

    Fixed in 0:1.3.13-2.el8cf
  47. Upgrade

    Upgrade redhat/rubygem-surro-gate to a version that resolves this vulnerability.

    Fixed in 0:1.0.5-1.el8cf
  48. Upgrade

    Upgrade redhat/rubygem-websocket-driver to a version that resolves this vulnerability.

    Fixed in 0:0.6.5-1.el8cf
  49. Upgrade

    Upgrade redhat/smem to a version that resolves this vulnerability.

    Fixed in 0:1.4-1.el8cf
  50. Upgrade

    Upgrade redhat/v2v-conversion-host to a version that resolves this vulnerability.

    Fixed in 0:1.14.2-1.el8e
  51. Upgrade

    Upgrade redhat/wmi to a version that resolves this vulnerability.

    Fixed in 0:1.3.14-8.el8cf
  52. Upgrade

    Upgrade redhat/ipa to a version that resolves this vulnerability.

    Fixed in 0:4.6.8-5.el7
  53. Upgrade

    Upgrade redhat/eap7-hal-console to a version that resolves this vulnerability.

    Fixed in 0:3.3.16-1.Final_redhat_00001.1.el8ea
  54. Upgrade

    Upgrade redhat/eap7-hal-console to a version that resolves this vulnerability.

    Fixed in 0:3.3.16-1.Final_redhat_00001.1.el9ea
  55. Upgrade

    Upgrade redhat/eap7-hal-console to a version that resolves this vulnerability.

    Fixed in 0:3.3.16-1.Final_redhat_00001.1.el7ea
  56. Upgrade

    Upgrade redhat/ovirt-engine-api-explorer to a version that resolves this vulnerability.

    Fixed in 0:0.0.4-1.el7e
  57. Upgrade

    Upgrade redhat/ovirt-engine-api-explorer to a version that resolves this vulnerability.

    Fixed in 0:0.0.5-1.el7e
  58. Upgrade

    Upgrade redhat/ovirt-engine-ui-extensions to a version that resolves this vulnerability.

    Fixed in 0:1.0.10-1.el7e
  59. Upgrade

    Upgrade nuget/bootstrap.sass to a version that resolves this vulnerability.

    Fixed in 4.0.0-beta.2
  60. Upgrade

    Upgrade rubygems/bootstrap-sass to a version that resolves this vulnerability.

    Fixed in 3.4.0
  61. Upgrade

    Upgrade npm/bootstrap-sass to a version that resolves this vulnerability.

    Fixed in 3.4.0
  62. Upgrade

    Upgrade nuget/bootstrap to a version that resolves this vulnerability.

    Fixed in 4.0.0-beta.2
  63. Upgrade

    Upgrade nuget/bootstrap to a version that resolves this vulnerability.

    Fixed in 3.4.0
  64. Upgrade

    Upgrade composer/twbs/bootstrap to a version that resolves this vulnerability.

    Fixed in 4.0.0-beta.2
  65. Upgrade

    Upgrade composer/twbs/bootstrap to a version that resolves this vulnerability.

    Fixed in 3.4.0
  66. Upgrade

    Upgrade rubygems/bootstrap to a version that resolves this vulnerability.

    Fixed in 4.0.0-beta.2
  67. Upgrade

    Upgrade maven/org.webjars:bootstrap to a version that resolves this vulnerability.

    Fixed in 4.0.0-beta.2
  68. Upgrade

    Upgrade maven/org.webjars:bootstrap to a version that resolves this vulnerability.

    Fixed in 3.4.0
  69. Upgrade

    Upgrade npm/bootstrap to a version that resolves this vulnerability.

    Fixed in 3.4.0
  70. Upgrade

    Upgrade npm/bootstrap to a version that resolves this vulnerability.

    Fixed in 4.0.0-beta.2
  71. Upgrade

    Upgrade redhat/bootstrap to a version that resolves this vulnerability.

    Fixed in 3.4.0
  72. Upgrade

    Upgrade redhat/bootstrap to a version that resolves this vulnerability.

    Fixed in 4.0.0
  73. Upgrade

    Upgrade Bootstrap to a version that resolves this vulnerability.

    Fixed in 3.4.0
  74. Upgrade

    Upgrade Bootstrap to a version that resolves this vulnerability.

    Fixed in 4.0.0-beta.2

Event History

Jun 27, 2016
CVE Published
12:00 AM
Jan 9, 2019
CVE Published
via MITRE·05:00 AM
Data Sourced
via MITRE·05:00 AM
Description
Jan 17, 2019
Advisory Published
via GitHub·01:57 PM
Jan 21, 2019
Data Sourced
via Red Hat·09:42 PM
DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the severity of CVE-2016-10735?

CVE-2016-10735 is classified as a medium severity vulnerability due to the potential for cross-site scripting attacks.

2

How do I fix CVE-2016-10735?

To fix CVE-2016-10735, update your Bootstrap version to 4.0.0 or later.

3

Which versions of Bootstrap are affected by CVE-2016-10735?

Bootstrap versions prior to 4.0.0 are affected by CVE-2016-10735.

4

What type of vulnerability is CVE-2016-10735?

CVE-2016-10735 is a cross-site scripting vulnerability that allows remote code execution in a victim's browser.

5

Who is impacted by CVE-2016-10735?

Web applications utilizing vulnerable versions of Bootstrap are potentially impacted by CVE-2016-10735.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203