CVE-2024-13919

Packagist/laravel/framework CVE-2024-13919: medium 4.7, EPSS 0.53%

Laravel framework susceptible to reflected cross-site scripting

Action: Upgrade laravel/framework to 11.36.0 or later.

composer require laravel/framework:11.36.0

Affected

Fixed versions

Sources

• osv: GHSA-83wp-f5c3-hqqr
• https://nvd.nist.gov/vuln/detail/CVE-2024-13919
• https://github.com/laravel/framework/pull/53869
• https://github.com/laravel/framework/commit/45287fb2a91c69bb1c110539b9b7341faf5aee33
• https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2024-13919.yaml
• https://github.com/laravel/framework
• https://github.com/laravel/framework/releases/tag/v11.36.0
• https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20241209-02_Laravel_Reflected_XSS_via_Route_Parameter_in_Debug-Mode_Error_Page
• http://www.openwall.com/lists/oss-security/2025/03/10/4

CVE-2024-13919 · published 2025-03-10T12:30:55Z · modified 2025-03-14T21:02:02.468053Z · JSON