CVE-2024-13918

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2024-13918

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-13918.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-13918

Aliases

GHSA-546h-56qp-8jmw

Published

2025-03-10T10:15:10Z

Modified

2025-03-11T14:56:05.195564Z

Summary

[none]

Details

The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.

References

Affected packages

Debian:11 / php-laravel-framework

Package

Name: php-laravel-framework
Purl: pkg:deb/debian/php-laravel-framework?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

6.*

6.20.14+dfsg-2

6.20.14+dfsg-2+deb11u1

6.20.14+dfsg-2+deb11u2

6.20.14+dfsg-3

8.*

8.83.26+dfsg-1

8.83.26+dfsg-2

10.*

10.48.25+dfsg-1

10.48.25+dfsg-2

11.*

11.44.0-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / php-laravel-framework

Package

Name: php-laravel-framework
Purl: pkg:deb/debian/php-laravel-framework?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

8.*

8.83.26+dfsg-2

10.*

10.48.25+dfsg-1

10.48.25+dfsg-2

11.*

11.44.0-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / php-laravel-framework

Package

Name: php-laravel-framework
Purl: pkg:deb/debian/php-laravel-framework?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

8.*

8.83.26+dfsg-2

10.*

10.48.25+dfsg-1

10.48.25+dfsg-2

11.*

11.44.0-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}