{"id":"CVE-2024-21504","published":"2024-03-19T05:00:00Z","modified":"2024-08-27T20:55:55Z","title":"Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS)…","vendor":null,"product":null,"tier":"tail","description":{"text":"Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property. An attacker can inject HTML code in the context of the user's browser session by crafting a malicious link and convincing the user to click on it.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00516,"percentile":0.43824,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-PHP-LIVEWIRELIVEWIRE-6446222","tags":[]},{"url":"https://github.com/livewire/livewire/releases/tag/v3.4.9","tags":[]},{"url":"https://github.com/livewire/livewire/pull/8117","tags":[]},{"url":"https://github.com/livewire/livewire/commit/c65b3f0798ab2c9338213ede3588c3cdf4e6fcc0","tags":[]}],"priority":{"score":13.0,"factors":[{"name":"EPSS percentile","points":8.76},{"name":"CVSS severity","points":4.27}]},"affectedVersions":[{"vendor":"n/a","product":"livewire/livewire","versions":[">= 3.3.5, < 3.4.9"]}],"affected":[{"ecosystem":"Packagist","package":"livewire/livewire","vulnerableRanges":[">=3.3.5, <3.4.9"],"patched":["3.4.9"],"from":["GHSA-389c-cf87-qmwj"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-0800","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-21504","published":"2024-03-19","fixed":"3.4.9","kev":false},{"cve":"CVE-2024-47823","published":"2024-10-08","fixed":"3.5.2","kev":false,"link":{"from":"CVE-2024-21504","to":"CVE-2024-47823","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:livewire/livewire","fromFixed":"3.4.9","toFixed":"3.5.2","daysApart":203}]}},{"cve":"CVE-2025-54068","published":"2025-07-17","fixed":"3.6.4","kev":true},{"cve":"CVE-2026-81887","published":"2026-08-31","fixed":"4.3.4","kev":false}],"package":"Packagist:livewire/livewire"}}