In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8331
Reference (s):
- BID:107375
- URL: http://www.securityfocus.com/bid/107375
- BUGTRAQ:20190509 dotCMS v5.1.1 Vulnerabilities
- URL: https://seclists.org/bugtraq/2019/May/18
- https://www.tenable.com/security/tns-2021-14

