Miggo Logo
Miggo Vulnerability Database
→
CVE-2014-4920

CVE-2014-4920:
Reflective Cross-site Scripting Vulnerability in twitter-bootstrap-rails

N/A

CVSS Score

Basic Information

CVE ID
CVE-2014-4920
GHSA ID
GHSA-vpqv-mqvc-pcx2
EPSS Score
-
CWE
CWE-79
Published
3/16/2023
Updated
3/16/2023
KEV Status
No
Technology
TechnologyRuby

Technical Details

CVSS Vector
vuln_not_found
Package NameEcosystemVulnerable VersionsFirst Patched Version
twitter-bootstrap-railsrubygems< 3.2.03.2.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The advisory explicitly states the vulnerability exists in the bootstrap_flash helper method's lack of input validation. As a flash message handler that directly outputs user-influenced content without sanitization, it creates an XSS vector. The description directly links this method to the vulnerability mechanism, and the patched version (3.2.0) likely adds proper sanitization here.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T** twitt*r-*ootstr*p-r*ils **m *or R*ils *ont*ins * *l*w t**t *n**l*s * r**l**t** *ross-sit* s*riptin* (XSS) *tt**k. T*is *l*w *xists ****us* t** *ootstr*p_*l*s* **lp*r m*t*o* *o*s not v*li**t* input w**n **n*lin* *l*s* m*ss***s ***or* r*turnin* it

Reasoning

T** **visory *xpli*itly st*t*s t** vuln*r**ility *xists in t** `*ootstr*p_*l*s*` **lp*r m*t*o*'s l**k o* input v*li**tion. *s * *l*s* m*ss*** **n*l*r t**t *ir**tly outputs us*r-in*lu*n*** *ont*nt wit*out s*nitiz*tion, it *r**t*s *n XSS v**tor. T** **