Filament Fixes Cross-Site Scripting vulnerability Affecting Laravel Applications
CVE-2024-47186

6.1MEDIUM

Key Information:

Vendor
Filament
Status
Filament
Vendor
CVE Published:
27 September 2024

Summary

Filament is a collection of full-stack components for Laravel development. Versions of Filament from v3.0.0 through v3.2.114 are affected by a cross-site scripting (XSS) vulnerability. If values passed to a ColorColumn or ColumnEntry are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a color column or entry is rendered. Filament v3.2.115 fixes this issue.

References

https://github.com/filamentphp/filament/security/advisori...
https://github.com/filamentphp/filament/commit/df79893524...
https://github.com/filamentphp/filament/releases/tag/v3.2...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.