twitter-bootstrap-rails 1.4.2

2 security vulnerabilities found in version 1.4.2

twitter-bootstrap-rails vulnerable to Cross-Site Scripting (XSS)

medium severity CVE-2019-8331

The seyhunak/twitter-bootstrap-rails gem includes a vendored version of the Bootstrap JavaScript library.

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

The most recent version of this gem, 5.0.0, includes Bootstrap v 3.3.6. All versions of Bootstrap before v 3.4.1 are affected by this vulnerability. All versions of this gem are affected.

Workarounds

Until this gem is updated to use Bootstrap v3.4.1, users can replace it with the official Twitter-maintained gems, bootstrap-sass (version 3.4.1) or bootstrap (bootstrap 4 and 5).

Reflective XSS Vulnerability in twitter-bootstrap-rails

medium severity CVE-2014-4920

Patched versions: >= 3.2.0

The twitter-bootstrap-rails Gem for Rails contains a flaw that enables a reflected cross-site scripting (XSS) attack. This flaw exists because the bootstrap_flash helper method does not validate input when handling flash messages before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.

No officially reported memory leakage issues detected.

This gem version does not have any officially reported memory leaked issues.

Gem version without a license.

Unless a license that specifies otherwise is included, nobody can use, copy, distribute, or modify this library without being at risk of take-downs, shake-downs, or litigation.

This gem version is available.

This gem version has not been yanked and is still available for usage.