CVE:CVE-2018-14041
CNNVD:CNNVD-201807-1189
Bootstrap是一款使用HTML、CSS和JavaScript开发的开源Web前端框架。
Bootstrap 4.1.2之前版本中的scrollspy的data-target属性存在跨站脚本漏洞。远程攻击者可利用该漏洞注入任意的Web脚本或HTML。
solution:Upgrade getbootstrap bootstrap to a higher version than 4.1.2,4.0.0:alpha,4.0.0:alpha2,4.0.0:alpha3,4.0.0:alpha4,4.0.0:alpha5,4.0.0:alpha6,4.0.0:beta,4.0.0:beta2,4.0.0:beta3,and avoid the version [4.0.0,4.1.2),4.0.0:alpha,4.0.0:alpha2,4.0.0:alpha3,4.0.0:alpha4,4.0.0:alpha5,4.0.0:alpha6,4.0.0:beta,4.0.0:beta2,4.0.0:beta3