[Bug]: nextcloud acunetix scan is showing bootstrap version 3.3.5 is vulnerable to cross site scripting attacks.

[Knkkyl]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Bootstrap Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability. In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.
References
CVE-2018-14040,CVE-2018-20677,CVE-2018-14042,CVE-2018-20676 & CVE-2019-8331

Steps to reproduce

1. Perform acunetix scan of nextcloud

Expected behavior

acunetix scan should report latest bootstrap version

Installation method

Community Manual installation with Archive

Nextcloud Server version

27

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.1

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

No response

List of activated Apps

No response

Nextcloud Signing status

No response

Nextcloud Logs

No response

Additional info

No response

[joshtrichards]

Can you be more specific? Is this a clean installation? What file is this showing up?

We don't ship with ancient bootstrap versions like that in any of our supported versions of Server anywhere I can see:

• stable26: https://github.com/nextcloud/3rdparty/blob/313ca384261c23ac5bbcdd926a473c76cfc905b4/composer.lock#L4282-L4283C25
• stable27: https://github.com/nextcloud/3rdparty/blob/9e98dce036c0c2654f1ce33387f5d3e73488349e/composer.lock#L4293-L4294
• stable28: https://github.com/nextcloud/3rdparty/blob/9aabf1a490571ef88073d069222e9a232b772fc8/composer.lock#L4172-L4173

FYI, in the future please use the appropriate channel for vulnerability reports: https://github.com/nextcloud/server/blob/master/SECURITY.md#reporting-a-vulnerability

[ghost]

Please refer dist/core-common.js . If you grep this file for Bootstrap you will get a hit for version 3.3.5

[joshtrichards]

nextcloud-libraries/nextcloud-vue#3979

[solracsf]

See also #17959

[skjnldsv]

Deps updated and/or removed on latests versions