CVE-2024-21504
Assigner: snyk
Published: 2024-03-19T05:00:00.698Z
State: PUBLISHED
metrics: cvssV3_1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P
credits: value: Dan Harrin
problemTypes: descriptions: cweId: CWE-79
description: Cross-site Scripting (XSS)
descriptions: value: Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property. An attacker can inject HTML code in the context of the user's browser session by crafting a malicious link and convincing the user to click on it.
affected: product: livewire/livewire
versions: version: 3.3.5
lessThan: 3.4.9
status: affected
versionType: semver
vendor: n/a