Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/laravel/framework ↗ | |
| All commits before 251e09a2ecf41241b9892fe490eb301d5c9721b9 | 251e09a2ecf41241b9892fe490eb301d5c9721b9 |
| 0b12ef19623c40e22eff91a4b48cb13b3b415b25 to before ecdafad1dda3c790af186a6d18479ea4757ef9ee | ecdafad1dda3c790af186a6d18479ea4757ef9ee |
| 43bea00fd27c76c01fd009e46725a54885f4d2a5 to before 0bb91d3176357da232da69762a64b0e0a0988637 | 0bb91d3176357da232da69762a64b0e0a0988637 |
| Not specified | b8174169b1807f36de1837751599e2828ceddb9b |
Also listed as affected (297)
| |
Description
Laravel is a web application framework. Laravel prior to versions 8.75.0, 7.30.6, and 6.20.42 contain a possible cross-site scripting (XSS) vulnerability in the Blade templating engine. A broken HTML element may be clicked and the user taken to another location in their browser due to XSS. This is due to the user being able to guess the parent placeholder SHA-1 hash by trying common names of sections. If the parent template contains an exploitable HTML structure an XSS vulnerability can be exposed. This vulnerability has been patched in versions 8.75.0, 7.30.6, and 6.20.42 by determining the parent placeholder at runtime and using a random hash that is unique to each request.
References
- Advisorygithub.com/laravel/framework/releases/tag/v6.20.42 ↗
- Advisorygithub.com/laravel/framework/releases/tag/v7.30.6 ↗
- Advisorygithub.com/laravel/framework/releases/tag/v8.75.0 ↗
- Fixgithub.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b ↗
- Fixgithub.com/laravel/framework/pull/39906 ↗
- Fixgithub.com/laravel/framework/pull/39908 ↗
- Fixgithub.com/laravel/framework/pull/39909 ↗
- EVIDENCEgithub.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw ↗