PT-2024-19589 · Livewire · Livewire

Published 2024-02-01 · Updated 2024-08-01 · CVE-2024-22859

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions livewire versions prior to 3.0.4

Description A Cross-Site Request Forgery (CSRF) issue allows remote attackers to execute arbitrary code via the getCsrfToken function. The vendor disputes this, stating that the 5d88731 commit fixes a usability problem, not a security problem.

Recommendations For versions prior to 3.0.4, update to version 3.0.4 or later to resolve the issue. As a temporary workaround, consider disabling the getCsrfToken function until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-22859

GHSA-2CJH-75GP-34GC

Affected Products

Livewire

References · 12

• https://github.com/livewire/livewire/commit/5d887316f2aaf83c0e380ac5e72766f19700fa3b · Patch
• https://osv.dev/vulnerability/CVE-2024-22859 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22859 · Security Note
• https://osv.dev/vulnerability/GHSA-2cjh-75gp-34gc · Vendor Advisory
• https://github.com/livewire/livewire · Note
• https://github.com/github/advisory-database/pull/3490 · Note
• https://twitter.com/VulmonFeeds/status/1753024022223204502 · Twitter Post
• https://t.me/cvenotify/69546 · Telegram Post
• https://t.me/cvenotify/69500 · Telegram Post
• https://t.me/cvenotify/70965 · Telegram Post
• https://t.me/cvenotify/70237 · Telegram Post
• https://t.me/cvenotify/88382 · Telegram Post