CVE-2024-47186 Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting
Attackers can inject malicious scripts via unvalidated color values in Filament components, potentially compromising user sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-47186?
CVE-2024-47186 is a medium-severity cross-site scripting vulnerability in filamentphp filament, published on 27 Sep 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Filament is a collection of full-stack components for Laravel development. Versions of Filament from v3.0.0 through v3.2.114 are affected by a cross-site scripting (XSS) vulnerability. If values passed to a `ColorColumn` or `ColumnEntry` are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a color column or entry is rendered. Filament v3.2.115 fixes this issue.
Weakness: CWE-79
Which versions are affected by CVE-2024-47186?
4 open source packages ship an affected version, including filament/infolists and filament/tables. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
filament/infolists Packagist | From 3.0.0 | 3.2.115 |
filament/infolists Packagist | From 3.0.0 | 3.2.115 |
filament/tables Packagist | From 3.0.0 | 3.2.115 |
filament/tables Packagist | From 3.0.0 | 3.2.115 |
Products include Filamentphp Filament.
How do I fix CVE-2024-47186?
Upgrade filament/infolists to 3.2.115 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-47186 being exploited?
There is no known exploitation of CVE-2024-47186 in the wild and no public exploit code.
Other vulnerabilities in filamentphp filament
Sources
Also known as GHSA-9h9q-qhxg-89xr.