CVE catalog

CVE-2024-6485

Bootstrap vulnerabilities

Severity: Medium · CVSS 6.4CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
Published: Jul 11, 2024, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.49% · Oct 25, 2026

A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	twitter-bootstrap3	sid	`3.4.1+dfsg-7`	fixed
Debian	twitter-bootstrap3	forky	`3.4.1+dfsg-7`	fixed
Debian	twitter-bootstrap3	trixie	`3.4.1+dfsg-6`	fixed
Debian	twitter-bootstrap3	bookworm	`3.4.1+dfsg-3+deb12u1`	fixed
Debian	twitter-bootstrap3	bookworm-security	`3.4.1+dfsg-3+deb12u2`	fixed
Debian	twitter-bootstrap4	sid	`4.6.2+dfsg-3`	not affected
Debian	twitter-bootstrap4	forky	`4.6.2+dfsg-3`	not affected
Debian	twitter-bootstrap4	trixie	`4.6.2+dfsg-1`	not affected
Debian	twitter-bootstrap4	bookworm	`4.6.1+dfsg1-4+deb12u1`	not affected
Ubuntu	twitter-bootstrap3	noble	`3.4.1+dfsg-3+deb12u1build0.24.04.1`	fixed
Ubuntu	twitter-bootstrap4	noble	`4.6.1+dfsg1-4+deb12u1build0.24.04.1`	fixed
Ubuntu	fonts-glyphicons-halflings	noble	`1.009~3.4.1+dfsg-3+deb12u1build0.24.04.1`	fixed
Ubuntu	libjs-bootstrap	noble	`3.4.1+dfsg-3+deb12u1build0.24.04.1`	fixed
Ubuntu	libjs-bootstrap4	noble	`4.6.1+dfsg1-4+deb12u1build0.24.04.1`	fixed
Ubuntu	twitter-bootstrap3	pro	`3.3.7+dfsg-2`	vulnerable
Ubuntu	twitter-bootstrap3	pro	`3.3.7+dfsg-2ubuntu0.1~esm1`	fixed
Ubuntu	twitter-bootstrap3	22.04	`3.4.1+dfsg-2`	vulnerable
Ubuntu	twitter-bootstrap3	22.04	`3.4.1+dfsg-2+deb11u2build0.22.04.1`	fixed
Ubuntu	twitter-bootstrap3	24.04	`3.4.1+dfsg-3`	vulnerable
Ubuntu	twitter-bootstrap3	24.04	`3.4.1+dfsg-3+deb12u1build0.24.04.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	twitter-bootstrap3	source	sid	`3.4.1+dfsg-4`	not yet assigned	Not reported	[1084060]
Debian	twitter-bootstrap3	source	forky	`3.4.1+dfsg-4`	not yet assigned	Not reported	[1084060]
Debian	twitter-bootstrap3	source	trixie	`3.4.1+dfsg-4`	not yet assigned	Not reported	[1084060]
Debian	twitter-bootstrap3	source	bookworm	`3.4.1+dfsg-3+deb12u1`	not yet assigned	Not reported	[1084060]
Debian	twitter-bootstrap4	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	twitter-bootstrap4	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	twitter-bootstrap4	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	twitter-bootstrap4	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
Ubuntu	twitter-bootstrap3	deb	noble	`3.4.1+dfsg-3+deb12u1build0.24.04.1`	Not reported	Not reported	Not reported
Ubuntu	twitter-bootstrap4	deb	noble	`4.6.1+dfsg1-4+deb12u1build0.24.04.1`	Not reported	Not reported	Not reported
Ubuntu	fonts-glyphicons-halflings	deb	noble	`1.009~3.4.1+dfsg-3+deb12u1build0.24.04.1`	Not reported	Not reported	Not reported
Ubuntu	libjs-bootstrap	deb	noble	`3.4.1+dfsg-3+deb12u1build0.24.04.1`	Not reported	Not reported	Not reported
Ubuntu	libjs-bootstrap4	deb	noble	`4.6.1+dfsg1-4+deb12u1build0.24.04.1`	Not reported	Not reported	Not reported
Ubuntu	twitter-bootstrap3	deb	pro	`3.3.7+dfsg-2ubuntu0.1~esm1`	Not reported	UBUNTU-CVE-2024-6485	Not reported
Ubuntu	twitter-bootstrap3	deb	22.04	`3.4.1+dfsg-2+deb11u2build0.22.04.1`	Not reported	UBUNTU-CVE-2024-6485	Not reported
Ubuntu	twitter-bootstrap3	deb	24.04	`3.4.1+dfsg-3+deb12u1build0.24.04.1`	Not reported	UBUNTU-CVE-2024-6485	Not reported

[Debian bug #1084060]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[fonts-glyphicons-halflings]Fixed
Source package: [twitter-bootstrap3]
Details (2)
- 1.009~3.4.1+dfsg-3+deb12u1 · all · bookworm
  Fixed · Fixed: 3.4.1+dfsg-3+deb12u1
  usn · twitter-bootstrap3 · debian · bookworm; usn · twitter-bootstrap3 · debian · 12
- 1.009~3.4.1+dfsg-3+deb12u1 · all · bookworm
  Fixed · Fixed: 3.4.1+dfsg-3+deb12u1
  usn · twitter-bootstrap3 · debian · bookworm; usn · twitter-bootstrap3 · debian · 12
[libjs-bootstrap]Fixed
Source package: [twitter-bootstrap3]
Details (2)
- 3.4.1+dfsg-3+deb12u1 · all · bookworm
  Fixed · Fixed: 3.4.1+dfsg-3+deb12u1
  usn · twitter-bootstrap3 · debian · bookworm; usn · twitter-bootstrap3 · debian · 12
- 3.4.1+dfsg-3+deb12u1 · all · bookworm
  Fixed · Fixed: 3.4.1+dfsg-3+deb12u1
  usn · twitter-bootstrap3 · debian · bookworm; usn · twitter-bootstrap3 · debian · 12
[libjs-bootstrap4]Not affected
Source package: [twitter-bootstrap4]
Details (2)
- 4.6.1+dfsg1-4+deb12u1 · all · bookworm
  Not affected
  usn · twitter-bootstrap4 · debian · bookworm
- 4.6.1+dfsg1-4+deb12u1 · all · bookworm
  Not affected
  usn · twitter-bootstrap4 · debian · bookworm

[Debian 13 (Trixie)]

[fonts-glyphicons-halflings]Fixed
Source package: [twitter-bootstrap3]
Details (2)
- 1.009~3.4.1+dfsg-6 · all · trixie
  Fixed · Fixed: 3.4.1+dfsg-4
  usn · twitter-bootstrap3 · debian · 13
- 1.009~3.4.1+dfsg-6 · all · trixie
  Fixed · Fixed: 3.4.1+dfsg-4
  usn · twitter-bootstrap3 · debian · 13
[libjs-bootstrap]Fixed
Source package: [twitter-bootstrap3]
Details (2)
- 3.4.1+dfsg-6 · all · trixie
  Fixed · Fixed: 3.4.1+dfsg-4
  usn · twitter-bootstrap3 · debian · 13
- 3.4.1+dfsg-6 · all · trixie
  Fixed · Fixed: 3.4.1+dfsg-4
  usn · twitter-bootstrap3 · debian · 13

Observed: Oct 27, 2026, 3:13:44 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [Ubuntu Security Notices (USN)]