Livewire Vulnerable to Cross-site Scripting (XSS) Attacks
CVE-2024-21504

6.1MEDIUM

Key Information:

Vendor

livewire

Status
Livewire/livewire
Vendor
CVE Published:
19 March 2024

What is CVE-2024-21504?

Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property. An attacker can inject HTML code in the context of the user's browser session by crafting a malicious link and convincing the user to click on it.

Affected Version(s)

livewire/livewire 3.3.5 < 3.4.9

References

https://security.snyk.io/vuln/SNYK-PHP-LIVEWIRELIVEWIRE-6...
https://github.com/livewire/livewire/releases/tag/v3.4.9
https://github.com/livewire/livewire/pull/8117

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dan Harrin
.