A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.

According to its self-reported version number, Bootstrap is prior to 4.0.0. Therefore, it may be affected by Multiples Cross-Site Scripting (XSS) vulnerability :

- A Cross-Site Scripting (XSS) vulnerability has been identified within the Bootstrap 3 Button component.

- A Cross-Site Scripting (XSS) vulnerability has been identified within the Bootstrap 3 Popover component and Bootstrap 3 Tooltip component, which allows unsanitized HTML to be used.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7556-1 advisory.

    It was discovered that Bootstrap did not correctly sanitize certain input in the carousel component. An     attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. (CVE-2024-6484,     CVE-2024-6531)

    It was discovered that Bootstrap did not correctly sanitize certain input in the button plugin. An     attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. (CVE-2024-6485)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4124 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4124-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     April 13, 2025                                https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : twitter-bootstrap3     Version        : 3.4.1+dfsg-2+deb11u1     CVE ID         : CVE-2024-6484 CVE-2024-6485     Debian Bug     : 1084060

    Bootstrap (formerly Twitter Bootstrap), a free and open-source CSS framework,     was affected by XSS vulnerabilities.

    If you use bootstrap through a module bundler, you may need to rebuild your     application.

    For Debian 11 bullseye, these problems have been fixed in version     3.4.1+dfsg-2+deb11u1.

    We recommend that you upgrade your twitter-bootstrap3 packages.

    For the detailed security status of twitter-bootstrap3 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/twitter-bootstrap3

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS)
    attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin.
    This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would
    then be executed when the button's loading state is triggered. (CVE-2024-6485)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS)     attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin.
    This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would     then be executed when the button's loading state is triggered. (CVE-2024-6485)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
114900	Bootstrap < 4.0.0 Multiples Cross-Site Scripting	Web App Scanning	Component Vulnerability	Version Based	medium
237866	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : Bootstrap vulnerabilities (USN-7556-1)	Nessus	Ubuntu Local Security Checks	Local	medium
234244	Debian dla-4124 : fonts-glyphicons-halflings - security update	Nessus	Debian Local Security Checks	Local	medium
421357	SCA: security update for bootstrap (GHSA-vxmc-5x29-h64v)	Tenable Cloud Security	SCA Checks	Local	medium
421357	SCA: security update for bootstrap (GHSA-vxmc-5x29-h64v)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
231067	Linux Distros Unpatched Vulnerability : CVE-2024-6485	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2024-6485

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium