CVE-2024-21504

low-risk
Published 2024-03-19

Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property. An attacker can inject HTML code in the context of the user's browser session by crafting a malicious link and convincing the user to click on it.

Do I need to act?

-
0.12% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.1/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Laravel

References (8)

Patch https://github.com/livewire/livewire/commit/c65b3f0798ab2c9338213ede3588c3cdf4e6...
Issue Tracking https://github.com/livewire/livewire/pull/8117
Release Notes https://github.com/livewire/livewire/releases/tag/v3.4.9
Exploit https://security.snyk.io/vuln/SNYK-PHP-LIVEWIRELIVEWIRE-6446222
Patch https://github.com/livewire/livewire/commit/c65b3f0798ab2c9338213ede3588c3cdf4e6...
Issue Tracking https://github.com/livewire/livewire/pull/8117
Release Notes https://github.com/livewire/livewire/releases/tag/v3.4.9
Exploit https://security.snyk.io/vuln/SNYK-PHP-LIVEWIRELIVEWIRE-6446222
29
/ 100
low-risk
Severity 23/34 · High
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal