Vulnerablity found

Server
1

below vulnerability found so can you give any solution for same.

Library bootstrap, version 3.3.6 is vulnerable.

CVE-2018-14041
CVE-2019-8331
CVE-2018-20677
CVE-2018-20676
CVE-2018-14042
CVE-2016-10735
CVE-2024-6485

2

The identified library bootstrap, version 3.3.6 is vulnerable.

The identified library jquery, version 1.12.0 is vulnerable.

default-src ‘self’; script-src ‘self’ ‘unsafe-inline’ ‘unsafe-eval’; style-src ‘self’ ‘unsafe-inline’;
img-src ‘self’ data:; font-src ‘self’ data:; connect-src ‘self’; object-src ‘none’; base-uri ‘self’;
frame-ancestors ‘self’; form-action ‘self’

style-src includes unsafe-inline.

3

We require solution for this vulnerability so we are plan to install in production server.

4

These are findings about library versions, not about how UrBackup uses them. I went through the web interface’s code, and none of the affected features are used:

  • The Bootstrap 3.3.6 CVEs are cross-site scripting through attacker-controlled data attributes on tooltips, popovers, collapse, scrollspy, affix and button loading text. The UrBackup interface doesn’t use tooltips, popovers, scrollspy, affix or loading text, and its only data attribute is a fixed one on the menu toggle.
  • The jQuery 1.12.0 CVEs need cross-domain AJAX requests, deep-merging untrusted objects, or passing untrusted HTML to jQuery’s .html()/.append(). The interface only sends JSON requests to its own server, only deep-merges its own settings and server data, and renders its pages from templates without going through jQuery’s HTML functions.

Upgrading the libraries would make the scanner quieter, but it wouldn’t make the server any safer, because nothing that the CVEs describe is used. Updating Bootstrap to 3.4.1 (the last 3.x release) would clear six of the seven Bootstrap findings; CVE-2024-6485 isn’t fixed in any 3.x release. Every jQuery 1.x version is still flagged, and moving to jQuery 3 would need testing, since the table, chart and dropdown plugins the interface uses depend on the old version. So an update would be nice to have, but there’s nothing broken for it to fix.

The Content-Security-Policy in your scan doesn’t come from UrBackup (the server doesn’t send one), so it must be set by your reverse proxy. The interface uses inline event handlers, so removing ‘unsafe-inline’ from script-src would break it.

The usual advice applies as well: don’t expose the web interface to the internet, or put it behind a reverse proxy with authentication.