CVE-2024-47186
Medium
Description
Filament is a collection of full-stack components for Laravel development. Versions of Filament from v3.0.0 through v3.2.114 are affected by a cross-site scripting (XSS) vulnerability. If values passed to a `ColorColumn` or `ColumnEntry` are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a color column or entry is rendered. Filament v3.2.115 fixes this issue.
SeverityMedium
CVSS6.1
Exploit probability—
Product
Filament
PublishedSep 27, 2024
First seenSep 27, 2024
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- filamentphp filament3.2.115 or later
- filament/tables3.2.115 or later
- filament/infolists3.2.115 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| filamentphp filament | 3.0.0 ≤ v < 3.2.115 | 3.2.115 |
| filament/tablesPackagist | 3.0.0 ≤ v < 3.2.115 | 3.2.115 |
| filament/infolistsPackagist | 3.0.0 ≤ v < 3.2.115 | 3.2.115 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.