CVE-2024-47186
Filament Cross-Site Scripting Vulnerability
Description
Filament is a collection of full-stack components for Laravel development. Versions of Filament from v3.0.0 through v3.2.114 are affected by a cross-site scripting (XSS) vulnerability. If values passed to a `ColorColumn` or `ColumnEntry` are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a color column or entry is rendered. Filament v3.2.115 fixes this issue.
INFO
Published Date :
Sept. 27, 2024, 9:15 p.m.
Last Modified :
Oct. 7, 2024, 1:30 p.m.
Source :
[email protected]
Remotely Exploitable :
Yes !
Impact Score :
2.7
Exploitability Score :
2.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-47186.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-47186 vulnerability anywhere in the article.
-
Cybersecurity News
Critical Laravel Flaw (CVE-2024-52301) Exposes Millions of Web Applications to Attack
A critical security vulnerability, CVE-2024-52301, has been identified in the Laravel framework, a popular web application framework known for its elegant syntax and comprehensive toolset for building ... Read more
-
Cybersecurity News
WhatsUp Gold Users Beware: Critical Authentication Bypass Flaw Exposed – CVE-2024-7763 (CVSS 9.8)
Progress Software has disclosed a severe new vulnerability in its popular network monitoring solution, WhatsUp Gold, that exposes organizations to potential cyberattacks by allowing unauthorized acces ... Read more
-
Cybersecurity News
CVE-2024-21216 (CVSS 9.8): Oracle WebLogic Flaw That Could Give Attackers Full Control
Oracle has recently rolled out its October 2024 Critical Patch Update (CPU), addressing 329 vulnerabilities across a variety of products. Among these are five severe vulnerabilities within the Oracle ... Read more
-
Cybersecurity News
CVE-2024-9634 (CVSS 9.8): Critical GiveWP Flaw Exposes 100,000+ WordPress Sites to RCE
A critical security vulnerability (CVE-2024-9634) has been discovered and patched in GiveWP, a popular WordPress donation plugin with over 100,000 active installations. The flaw, a PHP Object Injectio ... Read more
-
Cybersecurity News
CVE-2024-9921 (CVSS 9.8): Critical Flaw Found in Popular Business Collaboration Tool Team+
In a recent vulnerability note issued by TWCERT/CC (Taiwan Computer Emergency Response Team / Coordination Center), three significant security vulnerabilities have been identified in Team+, a popular ... Read more
-
Cybersecurity News
Critical Zero-Day Automotive Systems Vulnerabilities Exposed
Recent research by Amit Geynis, a leading security researcher, has highlighted the prevalence of critical vulnerabilities in modern vehicles, raising concerns about the safety and security of connecte ... Read more
-
Cybersecurity News
Linux Servers Under Siege: “Perfctl” Malware Evades Detection for Years
The entire attack flow | Image: Aqua NautilusIn a recent report by Aqua Nautilus researchers Assaf Morag and Idan Revivo, the Linux server community has been alerted to the presence of a particularly ... Read more
-
Cybersecurity News
Critical XSS Flaw Discovered in Filament: CVE-2024-47186 Requires Urgent Update for Laravel Developers
The Filament project, a popular collection of full-stack components for accelerated Laravel development, has issued a critical security advisory for CVE-2024-47186. This Cross-Site Scripting (XSS) vul ... Read more
The following table lists the changes that have been made to the
CVE-2024-47186 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Oct. 07, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Changed Reference Type https://github.com/filamentphp/filament/commit/df7989352464d08eda5837ef50f9997fad902316 No Types Assigned https://github.com/filamentphp/filament/commit/df7989352464d08eda5837ef50f9997fad902316 Patch Changed Reference Type https://github.com/filamentphp/filament/releases/tag/v3.2.115 No Types Assigned https://github.com/filamentphp/filament/releases/tag/v3.2.115 Release Notes Changed Reference Type https://github.com/filamentphp/filament/security/advisories/GHSA-9h9q-qhxg-89xr No Types Assigned https://github.com/filamentphp/filament/security/advisories/GHSA-9h9q-qhxg-89xr Vendor Advisory Added CPE Configuration OR *cpe:2.3:a:filamentphp:filament:*:*:*:*:*:*:*:* versions from (including) 3.0.0 up to (excluding) 3.2.115 -
CVE Received by [email protected]
Sep. 27, 2024
Action Type Old Value New Value Added Description Filament is a collection of full-stack components for Laravel development. Versions of Filament from v3.0.0 through v3.2.114 are affected by a cross-site scripting (XSS) vulnerability. If values passed to a `ColorColumn` or `ColumnEntry` are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a color column or entry is rendered. Filament v3.2.115 fixes this issue. Added Reference GitHub, Inc. https://github.com/filamentphp/filament/security/advisories/GHSA-9h9q-qhxg-89xr [No types assigned] Added Reference GitHub, Inc. https://github.com/filamentphp/filament/commit/df7989352464d08eda5837ef50f9997fad902316 [No types assigned] Added Reference GitHub, Inc. https://github.com/filamentphp/filament/releases/tag/v3.2.115 [No types assigned] Added CWE GitHub, Inc. CWE-79 Added CVSS V3.1 GitHub, Inc. AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-47186 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-47186
weaknesses.