CVE-2024-47186

{"id": "CVE-2024-47186", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2024-09-27T21:15:03.443", "references": [{"url": "https://github.com/filamentphp/filament/commit/df7989352464d08eda5837ef50f9997fad902316", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/filamentphp/filament/releases/tag/v3.2.115", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/filamentphp/filament/security/advisories/GHSA-9h9q-qhxg-89xr", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Filament is a collection of full-stack components for Laravel development. Versions of Filament from v3.0.0 through v3.2.114 are affected by a cross-site scripting (XSS) vulnerability. If values passed to a `ColorColumn` or `ColumnEntry` are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a color column or entry is rendered. Filament v3.2.115 fixes this issue."}, {"lang": "es", "value": "Filament es una colecci\u00f3n de componentes full-stack para el desarrollo de Laravel. Las versiones de Filament desde la v3.0.0 hasta la v3.2.114 se ven afectadas por una vulnerabilidad de cross site scripting (XSS). Si los valores que se pasan a `ColorColumn` o `ColumnEntry` no son v\u00e1lidos y contienen un conjunto espec\u00edfico de caracteres, las aplicaciones son vulnerables a ataques XSS contra un usuario que abre una p\u00e1gina en la que se representa una columna o entrada de color. Filament v3.2.115 corrige este problema."}], "lastModified": "2024-10-07T13:30:55.640", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:filamentphp:filament:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06A709B0-893D-4B65-9C67-C40A560F08A2", "versionEndExcluding": "3.2.115", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}