CVE-2024-21504

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-21504

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

V

ersions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property. An attacker can inject HTML code in the context of the user's browser session by crafting a malicious link and convincing the user to click on it.

References
Link Resource
https://github.com/livewire/livewire/commit/c65b3f0798ab2c9338213ede3588c3cdf4e6fcc0 Patch
https://github.com/livewire/livewire/pull/8117 Issue Tracking Patch
https://github.com/livewire/livewire/releases/tag/v3.4.9 Release Notes
https://security.snyk.io/vuln/SNYK-PHP-LIVEWIRELIVEWIRE-6446222 Exploit Third Party Advisory
https://github.com/livewire/livewire/commit/c65b3f0798ab2c9338213ede3588c3cdf4e6fcc0 Patch
https://github.com/livewire/livewire/pull/8117 Issue Tracking Patch
https://github.com/livewire/livewire/releases/tag/v3.4.9 Release Notes
https://security.snyk.io/vuln/SNYK-PHP-LIVEWIRELIVEWIRE-6446222 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:laravel:livewire:*:*:*:*:*:*:*:*
History

25 Aug 2025, 17:59

Type Values Removed Values Added
References () https://github.com/livewire/livewire/commit/c65b3f0798ab2c9338213ede3588c3cdf4e6fcc0 - () https://github.com/livewire/livewire/commit/c65b3f0798ab2c9338213ede3588c3cdf4e6fcc0 - Patch
References () https://github.com/livewire/livewire/pull/8117 - () https://github.com/livewire/livewire/pull/8117 - Issue Tracking, Patch
References () https://github.com/livewire/livewire/releases/tag/v3.4.9 - () https://github.com/livewire/livewire/releases/tag/v3.4.9 - Release Notes
References () https://security.snyk.io/vuln/SNYK-PHP-LIVEWIRELIVEWIRE-6446222 - () https://security.snyk.io/vuln/SNYK-PHP-LIVEWIRELIVEWIRE-6446222 - Exploit, Third Party Advisory
CPE cpe:2.3:a:laravel:livewire:*:*:*:*:*:*:*:*
First Time Laravel livewire
Laravel

21 Nov 2024, 08:54

Type Values Removed Values Added
References () https://github.com/livewire/livewire/commit/c65b3f0798ab2c9338213ede3588c3cdf4e6fcc0 - () https://github.com/livewire/livewire/commit/c65b3f0798ab2c9338213ede3588c3cdf4e6fcc0 -
References () https://github.com/livewire/livewire/pull/8117 - () https://github.com/livewire/livewire/pull/8117 -
References () https://github.com/livewire/livewire/releases/tag/v3.4.9 - () https://github.com/livewire/livewire/releases/tag/v3.4.9 -
References () https://security.snyk.io/vuln/SNYK-PHP-LIVEWIRELIVEWIRE-6446222 - () https://security.snyk.io/vuln/SNYK-PHP-LIVEWIRELIVEWIRE-6446222 -
Information

Published : 2024-03-19 05:15

Updated : 2025-08-25 17:59

NVD link : CVE-2024-21504

Mitre link : CVE-2024-21504

CVE.ORG link : CVE-2024-21504

JSON object : View

Products Affected

laravel

CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')