CVE-2019-10842: getbootstrap bootstrap-sass Improper Control of Generation of Code
Vulnerability summary
CVE-2019-10842 is a high (CVSS 10.0) Improper Control of Generation of Code vulnerability in getbootstrap bootstrap-sass. EPSS estimates a 4.92% chance of exploitation in the next 30 days, higher than 92.1% of scored vulnerabilities. 2 public exploits are recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Timeline
- 04-04-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Arbitrary code execution (via backdoor code) was discovered in bootstrap-sass 3.2.0.3, when downloaded from rubygems.org. An unauthenticated attacker can craft the ___cfduid cookie value with base64 arbitrary code to be executed via eval(), which can be leveraged to execute arbitrary code on the target system. Note that there are three underscore characters in the cookie name. This is unrelated to the __cfduid cookie that is legitimately used by Cloudflare.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · RubygemsEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
4.92%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
No change 0.00 pp
From 4.92% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (snyk.io)
Maturity: unknown
Exploit Reference (snyk.io)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Getbootstrap1 product
- bootstrap-sass3.2.0.3
RubyGems1 product
- bootstrap-sass≥ 3.2.0.3, < 3.2.0.4
2 vendors · 2 products
