Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2024-47186

Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting

Description

Filament is a collection of full-stack components for Laravel development. Versions of Filament from v3.0.0 through v3.2.114 are affected by a cross-site scripting (XSS) vulnerability. If values passed to a `ColorColumn` or `ColumnEntry` are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a color column or entry is rendered. Filament v3.2.115 fixes this issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

filamentphp filament

  • >= 3.0.0, < 3.2.115affected

References