PT-2024-18919 · Unknown · Livewire/Livewire

Dan Harrin · Published 2024-03-18 · Updated 2024-03-19 · CVE-2024-21504

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions livewire/livewire versions 3.3.5 through 3.4.9

Description The issue allows an attacker to inject HTML code in the context of the user's browser session by crafting a malicious link and convincing the user to click on it. This occurs when a page uses [Url] for a property.

Recommendations For versions 3.3.5 through 3.4.9, update to version 3.4.9 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-21504

GHSA-389C-CF87-QMWJ

Affected Products

Livewire/Livewire

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-21504 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21504 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-389c-cf87-qmwj · Vendor Advisory
• https://github.com/livewire/livewire · Note
• https://github.com/livewire/livewire/commit/c65b3f0798ab2c9338213ede3588c3cdf4e6fcc0 · Note
• https://github.com/livewire/livewire/pull/8117 · Note
• https://github.com/livewire/livewire/releases/tag/v3.4.9 · Note
• https://security.snyk.io/vuln/SNYK-PHP-LIVEWIRELIVEWIRE-6446222 · Note
• https://twitter.com/CVEnew/status/1769955833075372341 · Twitter Post
• https://t.me/cvenotify/74219 · Telegram Post