CVE-2024-13918: Laravel framework susceptible to reflected cross-site scripting
(updated )
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.
References
- github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2024-13918.yaml
- github.com/advisories/GHSA-546h-56qp-8jmw
- github.com/laravel/framework
- github.com/laravel/framework/commit/45287fb2a91c69bb1c110539b9b7341faf5aee33
- github.com/laravel/framework/pull/53869
- github.com/laravel/framework/releases/tag/v11.36.0
- github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20241209-01_Laravel_Reflected_XSS_via_Request_Parameter_in_Debug-Mode_Error_Page
- nvd.nist.gov/vuln/detail/CVE-2024-13918
Code Behaviors & Features
Detect and mitigate CVE-2024-13918 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →