CVE-2024-47186

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-47186", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-09-19T22:32:11.963Z", "datePublished": "2024-09-27T21:04:33.587Z", "dateUpdated": "2024-09-27T21:56:30.280Z"}, "containers": {"cna": {"title": "Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/filamentphp/filament/security/advisories/GHSA-9h9q-qhxg-89xr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/filamentphp/filament/security/advisories/GHSA-9h9q-qhxg-89xr"}, {"name": "https://github.com/filamentphp/filament/commit/df7989352464d08eda5837ef50f9997fad902316", "tags": ["x_refsource_MISC"], "url": "https://github.com/filamentphp/filament/commit/df7989352464d08eda5837ef50f9997fad902316"}, {"name": "https://github.com/filamentphp/filament/releases/tag/v3.2.115", "tags": ["x_refsource_MISC"], "url": "https://github.com/filamentphp/filament/releases/tag/v3.2.115"}], "affected": [{"vendor": "filamentphp", "product": "filament", "versions": [{"version": ">= 3.0.0, < 3.2.115", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-09-27T21:04:33.587Z"}, "descriptions": [{"lang": "en", "value": "Filament is a collection of full-stack components for Laravel development. Versions of Filament from v3.0.0 through v3.2.114 are affected by a cross-site scripting (XSS) vulnerability. If values passed to a `ColorColumn` or `ColumnEntry` are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a color column or entry is rendered. Filament v3.2.115 fixes this issue."}], "source": {"advisory": "GHSA-9h9q-qhxg-89xr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-27T21:55:24.935420Z", "id": "CVE-2024-47186", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-27T21:56:30.280Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-47186", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-09-19T22:32:11.963Z", "datePublished": "2024-09-27T21:04:33.587Z", "dateUpdated": "2024-09-27T21:56:30.280Z"}, "containers": {"cna": {"title": "Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/filamentphp/filament/security/advisories/GHSA-9h9q-qhxg-89xr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/filamentphp/filament/security/advisories/GHSA-9h9q-qhxg-89xr"}, {"name": "https://github.com/filamentphp/filament/commit/df7989352464d08eda5837ef50f9997fad902316", "tags": ["x_refsource_MISC"], "url": "https://github.com/filamentphp/filament/commit/df7989352464d08eda5837ef50f9997fad902316"}, {"name": "https://github.com/filamentphp/filament/releases/tag/v3.2.115", "tags": ["x_refsource_MISC"], "url": "https://github.com/filamentphp/filament/releases/tag/v3.2.115"}], "affected": [{"vendor": "filamentphp", "product": "filament", "versions": [{"version": ">= 3.0.0, < 3.2.115", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-09-27T21:04:33.587Z"}, "descriptions": [{"lang": "en", "value": "Filament is a collection of full-stack components for Laravel development. Versions of Filament from v3.0.0 through v3.2.114 are affected by a cross-site scripting (XSS) vulnerability. If values passed to a `ColorColumn` or `ColumnEntry` are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a color column or entry is rendered. Filament v3.2.115 fixes this issue."}], "source": {"advisory": "GHSA-9h9q-qhxg-89xr", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-47186", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-27T21:55:24.935420Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-27T21:49:15.814Z"}}]}}

{"affected": [{"affectedData": [{"product": "filament", "vendor": "filamentphp", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.2.115"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:filamentphp:filament:*:*:*:*:*:*:*:*", "matchCriteriaId": "06A709B0-893D-4B65-9C67-C40A560F08A2", "versionEndExcluding": "3.2.115", "versionStartIncluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Filament is a collection of full-stack components for Laravel development. Versions of Filament from v3.0.0 through v3.2.114 are affected by a cross-site scripting (XSS) vulnerability. If values passed to a `ColorColumn` or `ColumnEntry` are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a color column or entry is rendered. Filament v3.2.115 fixes this issue."}, {"lang": "es", "value": "Filament es una colecci\u00f3n de componentes full-stack para el desarrollo de Laravel. Las versiones de Filament desde la v3.0.0 hasta la v3.2.114 se ven afectadas por una vulnerabilidad de cross site scripting (XSS). Si los valores que se pasan a `ColorColumn` o `ColumnEntry` no son v\u00e1lidos y contienen un conjunto espec\u00edfico de caracteres, las aplicaciones son vulnerables a ataques XSS contra un usuario que abre una p\u00e1gina en la que se representa una columna o entrada de color. Filament v3.2.115 corrige este problema."}], "id": "CVE-2024-47186", "lastModified": "2026-06-17T07:56:41.633", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-47186", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-27T21:55:24.935420Z", "version": "2.0.3"}}]}, "published": "2024-09-27T21:15:03.443", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/filamentphp/filament/commit/df7989352464d08eda5837ef50f9997fad902316"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/filamentphp/filament/releases/tag/v3.2.115"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/filamentphp/filament/security/advisories/GHSA-9h9q-qhxg-89xr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}