CVE-2019-17433: XSS
Published Oct 10, 2019
·Updated
z-song laravel-admin 1.7.3 has XSS via the Slug or Name on the Roles screen, because of mishandling on the "Operation log" screen.
Affected Software
2 affected components
composer/encore/laravel-admin=1.7.3
laravel-admin laravel-admin=1.7.3
Event History
Oct 10, 2019
CVE Published
via MITRE·11:40 AM
Data Sourced
via MITRE·11:40 AM
Description
May 24, 2022
Advisory Published
via GitHub·04:58 PM
Frequently Asked Questions
1
What is the severity of CVE-2019-17433?
CVE-2019-17433 is considered a medium severity vulnerability due to its potential for exploitation through reflected XSS.
2
How do I fix CVE-2019-17433?
To fix CVE-2019-17433, update to a later version of laravel-admin beyond 1.7.3 that addresses this XSS vulnerability.
3
What types of attacks can exploit CVE-2019-17433?
CVE-2019-17433 can be exploited to perform Cross-Site Scripting (XSS) attacks by injecting malicious scripts in the Slug or Name fields.
4
Which applications are affected by CVE-2019-17433?
CVE-2019-17433 specifically affects z-song laravel-admin version 1.7.3.
5
Is user data safe from CVE-2019-17433?
User data may not be safe from CVE-2019-17433 if the application is vulnerable and proper input validation is not enforced.