CVE-2024-47186

Filament is a collection of full-stack components for Laravel development. Versions of Filament from v3.0.0 through v3.2.114 are affected by a cross-site scripting (XSS) vulnerability. If values passed to a `ColorColumn` or `ColumnEntry` are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a color column or entry is rendered. Filament v3.2.115 fixes this issue.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/filamentphp/filament/commit/df7989352464d08eda5837ef50f9997fad902316	Patch
https://github.com/filamentphp/filament/releases/tag/v3.2.115	Release Notes
https://github.com/filamentphp/filament/security/advisories/GHSA-9h9q-qhxg-89xr	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:filamentphp:filament:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-09-27 21:15

Updated : 2024-10-07 13:30

NVD link : CVE-2024-47186

Mitre link : CVE-2024-47186

CVE.ORG link : CVE-2024-47186

JSON object : View

Products Affected

filamentphp

filament

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-47186", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2024-09-27T21:15:03.443", "references": [{"url": "https://github.com/filamentphp/filament/commit/df7989352464d08eda5837ef50f9997fad902316", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/filamentphp/filament/releases/tag/v3.2.115", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/filamentphp/filament/security/advisories/GHSA-9h9q-qhxg-89xr", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Filament is a collection of full-stack components for Laravel development. Versions of Filament from v3.0.0 through v3.2.114 are affected by a cross-site scripting (XSS) vulnerability. If values passed to a `ColorColumn` or `ColumnEntry` are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a color column or entry is rendered. Filament v3.2.115 fixes this issue."}, {"lang": "es", "value": "Filament es una colecci\u00f3n de componentes full-stack para el desarrollo de Laravel. Las versiones de Filament desde la v3.0.0 hasta la v3.2.114 se ven afectadas por una vulnerabilidad de cross site scripting (XSS). Si los valores que se pasan a `ColorColumn` o `ColumnEntry` no son v\u00e1lidos y contienen un conjunto espec\u00edfico de caracteres, las aplicaciones son vulnerables a ataques XSS contra un usuario que abre una p\u00e1gina en la que se representa una columna o entrada de color. Filament v3.2.115 corrige este problema."}], "lastModified": "2024-10-07T13:30:55.640", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:filamentphp:filament:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06A709B0-893D-4B65-9C67-C40A560F08A2", "versionEndExcluding": "3.2.115", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}