Bootstrap: Mehrere Schwachstellen ermöglichen Cross-Site Scripting
WID-SEC-2024-1606 · first 12.07.2024 · updated 09.10.2026 · CVSS 6,4
What it is about
Bootstrap ist ein HTML-, CSS- und JavaScript-Framework für die Entwicklung responsiver Webprojekte. Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Bootstrap ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.
Under what conditions?
Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.
What can happen in the worst case
An attacker could use the vulnerability to
- einen Cross-Site Scripting Angriff durchzuführen
Am I affected?
Affected according to the BSI:
- Debian Linux
- IBM Power Hardware Management Console V10
- Open Source Bootstrap <5
- Open Source Camunda <7.20.9
- Open Source Camunda <7.21.6
- Open Source Camunda <7.22.1
- Open Source Camunda <7.23.0-alpha2
- Red Hat Enterprise Linux Discovery
- IBM DB2 on Cloud Pak for Data
- Hitachi Ops Center <11.0.4-00
- IBM Tivoli Network Manager IP Edition <4.2 Fix Pack 23
- IBM Storage Scale <5.2.3.4
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Open Source Bootstrap 5
- Open Source Camunda 7.20.9
- Open Source Camunda 7.21.6
- Open Source Camunda 7.22.1
- Open Source Camunda 7.23.0-alpha2
- Hitachi Ops Center 11.0.4-00
- IBM Tivoli Network Manager IP Edition 4.2 Fix Pack 23
- IBM Storage Scale 5.2.3.4
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- Camunda Security Notices docs.camunda.org
- herodevs vulnerability directory vom 2024-07-11 www.herodevs.com
- herodevs vulnerability directory vom 2024-07-11 www.herodevs.com
- herodevs vulnerability directory vom 2024-07-11 www.herodevs.com
- Red Hat Security Advisory RHSA-2025:1249 vom 2025-02-10 access.redhat.com
- IBM Security Bulletin 7228842 vom 2025-03-24 www.ibm.com
- IBM Security Bulletin 7229443 vom 2025-03-28 www.ibm.com
- Debian Security Advisory DLA-4124 vom 2025-04-13 lists.debian.org
- Debian Security Advisory DLA-4125 vom 2025-04-13 lists.debian.org
- Hitachi Vulnerability Information HITACHI-SEC-2025-113 vom 2025-05-15 www.hitachi.com
- IBM Security Bulletin 7243781 vom 2025-09-02 www.ibm.com
- IBM Security Bulletin 7248973 vom 2025-10-23 www.ibm.com
- Debian Security Advisory DLA-1479 vom 2026-10-09 security-tracker.debian.org
CVE: CVE-2024-6484, CVE-2024-6485, CVE-2024-6531
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.