drupal/bootstrap - SA-CONTRIB-2018-074
This base theme bridges the gap between Drupal and the Bootstrap Framework.
The theme doesn't sufficiently filter valid targets under the scenario of opening modals, popovers, and tooltips.
This vulnerability is mitigated by the fact that an attacker must already have the ability to either:
- Edit/save custom content that supplies a value for the
data-targetattribute by injecting malicious code. - Inject custom markup onto the page that further exploits the
data-targetattribute by injecting malicious code. This method of attack is highly unlikely if they already have this level of access.
Note: while the base-theme does not provide either of these opportunities to do this out-of-the-box; a custom sub-theme may, however, be susceptible if it didn't sanitize or filter user provided input for XSS properly.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | drupal/bootstrap | < 3.14.0 | 3.14.0 |
| Drupal module | drupal/bootstrap | < 3.14.0 | 3.14.0 |
References
- Weakness (CWE)
-- Platform
- Composer, Drupal
- Package
drupal/bootstrap- Disclosed
- 28.11.2018
- Updated
- 11.10.2026 12:18
Sources and licenses
OSV / GitHub Advisory Database - DRUPAL-CONTRIB-2018-074 - CC BY-SA 2.0; code GPL-2.0-or-later
Vulnerability history: drupal/bootstrap
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.