A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an <a> tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.

The version of reaper installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-6484 advisory.

  - A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks.
    The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be     exploited through the href attribute of an <a> tag due to inadequate sanitization. This vulnerability     could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.
    (CVE-2024-6484)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, Bootstrap is 3.2.x prior 3.4.1 . Therefore, it may be affected by a Cross-Site Scripting (XSS) vulnerability within the Carousel component.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7556-1 advisory.

    It was discovered that Bootstrap did not correctly sanitize certain input in the carousel component. An     attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. (CVE-2024-6484,     CVE-2024-6531)

    It was discovered that Bootstrap did not correctly sanitize certain input in the button plugin. An     attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. (CVE-2024-6485)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4124 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4124-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     April 13, 2025                                https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : twitter-bootstrap3     Version        : 3.4.1+dfsg-2+deb11u1     CVE ID         : CVE-2024-6484 CVE-2024-6485     Debian Bug     : 1084060

    Bootstrap (formerly Twitter Bootstrap), a free and open-source CSS framework,     was affected by XSS vulnerabilities.

    If you use bootstrap through a module bundler, you may need to rebuild your     application.

    For Debian 11 bullseye, these problems have been fixed in version     3.4.1+dfsg-2+deb11u1.

    We recommend that you upgrade your twitter-bootstrap3 packages.

    For the detailed security status of twitter-bootstrap3 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/twitter-bootstrap3

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
241854	CBL Mariner 2.0 Security Update: reaper (CVE-2024-6484)	Nessus	MarinerOS Local Security Checks	medium
114901	Bootstrap 3.2.x <= 3.4.1 Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium
237866	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : Bootstrap vulnerabilities (USN-7556-1)	Nessus	Ubuntu Local Security Checks	medium
234244	Debian dla-4124 : fonts-glyphicons-halflings - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2024-6484

medium

Tenable Plugins

medium

medium

medium

medium