CVE-2024-13919

Published Mar 10, 2025

Last updated 12 days ago

Laravel

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2024-13919 is a reflected cross-site scripting (XSS) vulnerability affecting the Laravel framework, specifically versions 11.9.0 through 11.35.1. It stems from the improper encoding of route parameters within the debug-mode error page. When Laravel's debug mode is enabled, detailed error messages are displayed, including the values of request and route parameters. If these values are not properly encoded, an attacker can inject malicious code, which is then reflected back to the user's browser, potentially leading to the execution of arbitrary JavaScript code. To exploit this, an attacker would need to trick a user into clicking a malicious link containing a crafted payload.

Description: The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page.
Source: 1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.1
Impact score: 2.7
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a: CWE-79
nvd@nist.gov: CWE-79

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A2A8A0BE-A7AA-4DA2-8A67-227CBBA94C18",
            "versionEndExcluding": "11.36.0",
            "versionStartIncluding": "11.9.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]