CVE-2024-13918

Packagist/laravel/framework CVE-2024-13918: medium 4.7

Laravel framework susceptible to reflected cross-site scripting

Action: Upgrade laravel/framework to 11.36.0 or later.

composer require laravel/framework:11.36.0

Affected

Fixed versions

Sources

• osv: GHSA-546h-56qp-8jmw
• https://nvd.nist.gov/vuln/detail/CVE-2024-13918
• https://github.com/laravel/framework/pull/53869
• https://github.com/laravel/framework/commit/45287fb2a91c69bb1c110539b9b7341faf5aee33
• https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2024-13918.yaml
• https://github.com/laravel/framework
• https://github.com/laravel/framework/releases/tag/v11.36.0
• https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20241209-01_Laravel_Reflected_XSS_via_Request_Parameter_in_Debug-Mode_Error_Page
• http://www.openwall.com/lists/oss-security/2025/03/10/3

CVE-2024-13918 · published 2025-03-10T12:30:55Z · modified 2025-03-11T14:52:15.641880Z · JSON