CVE-2024-13918

Published Mar 10, 2025

Last updated 12 days ago

Laravel

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2024-13918 is a reflected cross-site scripting (XSS) vulnerability affecting the Laravel framework, specifically versions between 11.9.0 and 11.35.1. This vulnerability stems from the improper encoding of request parameters within the debug-mode error page. An attacker could exploit this by injecting malicious code into a website, which is then reflected back to the user's browser. If a user clicks a malicious link containing this injected code, their browser could execute it, potentially allowing the attacker to steal sensitive information like cookies or session tokens, or even take control of the user's account. A patch has been released in version 11.36.0 to address this vulnerability.

Description: The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.
Source: 1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.1
Impact score: 2.7
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a: CWE-79
nvd@nist.gov: CWE-79

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A2A8A0BE-A7AA-4DA2-8A67-227CBBA94C18",
            "versionEndExcluding": "11.36.0",
            "versionStartIncluding": "11.9.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]