CVE-2024-6531
Publication date 11 July 2024
Last updated 4 August 2025
Ubuntu priority
Rejected reason: This was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| twitter-bootstrap3 | 25.04 plucky |
Not affected
|
| 24.04 LTS noble |
Not affected
|
|
| 22.04 LTS jammy |
Not affected
|
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
|
| twitter-bootstrap4 | 25.04 plucky |
Not affected
|
| 24.04 LTS noble |
Fixed 4.6.1+dfsg1-4+deb12u1build0.24.04.1
|
|
| 22.04 LTS jammy |
Fixed 4.6.0+dfsg1-4ubuntu0.1~esm1
|
|
| 20.04 LTS focal |
Fixed 4.4.1+dfsg1-2ubuntu0.1~esm1
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialSeverity score breakdown
| Parameter | Value |
|---|---|
| Base score |
6.4 · Medium
|
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | Low |
| Availability impact | Low |
| Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L |
References
Related Ubuntu Security Notices (USN)
- USN-7556-1
- Bootstrap vulnerabilities
- 5 June 2025