{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3af5big-ip_application_security_manager/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*","cpe:2.3:a:redhat:virtualization_manager:4.3:*:*:*:*:*:*:*","cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":6.1,"id":"CVE-2019-8331"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Bootstrap (\u003c 4.3.1)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Bootstrap"],"content_html":"\u003cp\u003eA security vulnerability (CVE-2019-8331) has been identified in the Bootstrap framework, specifically affecting versions prior to 4.3.1. This vulnerability allows a remote, unauthenticated attacker to conduct Cross-Site Scripting (XSS) attacks. By injecting malicious scripts into web applications that utilize vulnerable versions of Bootstrap, an attacker can execute code within the context of a victim's browser session. This can lead to session hijacking, credential theft, or the modification of web page content viewed by the user. Defenders should prioritize auditing web applications for these vulnerable versions of the Bootstrap framework and upgrade to version 4.3.1 or later to mitigate the risk.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this XSS vulnerability allows unauthorized actors to execute arbitrary scripts in the victim's browser. This poses a significant risk to the integrity and confidentiality of user data on affected web applications, potentially facilitating session hijacking or phishing attacks against users.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security and development teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAudit all web applications to identify dependencies using Bootstrap versions prior to 4.3.1.\u003c/li\u003e\n\u003cli\u003eUpgrade the Bootstrap framework to version 4.3.1 or later across all identified applications.\u003c/li\u003e\n\u003cli\u003eApply Content Security Policy (CSP) headers as a defense-in-depth measure to restrict the execution of unauthorized scripts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-09T13:11:43Z","date_published":"2026-10-09T13:11:43Z","id":"https://feed.craftedsignal.io/briefs/2026-10-bootstrap-xss/","summary":"A vulnerability in the Bootstrap framework allows for Cross-Site Scripting (XSS) attacks by an unauthenticated remote attacker, potentially leading to arbitrary script execution in a user's browser.","title":"Bootstrap Cross-Site Scripting Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-10-bootstrap-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:f5:big-Ip_application_security_manager:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}