CVE-2024-47186

Katalog CVE

CVSS 6.1 · Medium EPSS 0,42%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada filamentphp filament. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Filament is a collection of full-stack components for Laravel development. Versions of Filament from v3.0.0 through v3.2.114 are affected by a cross-site scripting (XSS) vulnerability. If values passed to a `ColorColumn` or `ColumnEntry` are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a color column or entry is rendered. Filament v3.2.115 fixes this issue.

Rincian

Terbit di NVD

27 September 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/filamentphp/filament/security/advisories/GHSA-9h9q-qhxg-89xr advisory vendor
• https://github.com/filamentphp/filament/commit/df7989352464d08eda5837ef50f9997fad902316 patch
• https://github.com/filamentphp/filament/releases/tag/v3.2.115 release notes