Impact area
Security
Severity
High
Affected element
ServiceNow
UI Script
Salesforce
Static Resource
Rule number #
SN-JSL-BOOTSTRAP-LESSTHAN-V210 (for ServiceNow)
SF-JSL-BOOTSTRAP-LESSTHAN-V210 (for Salesforce)
Impact #
Under some circumstances, it is possible to include an XSS attack on text passed to the bootstrap popover/tooltip function in versions before 2.1.0.
Remediation #
Update bootstrap to the latest version.
Time to fix #
30 min
References #
This rule is linked to Common Weakness Enumeration CWE-79 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’).
