In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
We have discovered 671,814 live websites that are affected by CVE-2019-8331.
| Product | |
| Category | UI Frameworks |
| Vulnerable Domains | 671,814 live websites (38% of Bootstrap install base) |
| Vulnerable Versions |
|
| Vulnerable Versions Count | 68 versions ( 32% of all versions) |
| 250,378 websites | |
| 42,605 websites | |
| 37,062 websites | |
| 29,806 websites | |
| 26,236 websites | |
| 24,143 websites | |
| 19,591 websites | |
| 16,382 websites | |
| 15,722 websites | |
| 13,892 websites |
| .com | 315,007 websites |
| .org | 28,338 websites |
| .de | 22,441 websites |
| .net | 21,826 websites |
| .co.uk | 18,137 websites |
| .ru | 16,188 websites |
| .nl | 15,790 websites |
| .com.br | 12,392 websites |
| .it | 12,030 websites |
| .fr | 11,850 websites |
| Domain | Country | Rank | Contacts |
|---|---|---|---|
| ********.com | *** | ||
| ******.com | *** | ||
| **.com | *** | ||
| *********.com | *** | ||
| *******.org | *,*** | ||
| ****.org | *,*** | ||
| *******.com | *,*** | ||
| ****.io | *,*** | ||
| ***.cn | *,*** | ||
| *****.com | *,*** |
FAQ