CVE-2024-13918: Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page
Published Mar 10, 2025
·Updated
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.
Affected Software
3 affected componentsFixes available
Laravel Laravel>=11.9.0<=11.35.1
composer/laravel/framework>=11.9.0<11.36.0
11.36.0
Laravel framework>=11.9.0<11.36.0
Remediation
Information
Update to version 11.36.0 or later.
Patch Available
Event History
Mar 10, 2025
CVE Published
via MITRE·10:02 AM
Data Sourced
via MITRE·10:02 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·10:15 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:15 AM
RemedyAffected Software
Advisory Published
via GitHub·12:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-13918?
CVE-2024-13918 has been assigned a high severity rating due to its potential for reflected cross-site scripting vulnerabilities.
2
How do I fix CVE-2024-13918?
To fix CVE-2024-13918, upgrade your Laravel framework to version 11.36.0 or later.
3
What causes CVE-2024-13918?
CVE-2024-13918 is caused by improper encoding of request parameters in the debug-mode error page.
4
Which versions of Laravel are affected by CVE-2024-13918?
Laravel framework versions between 11.9.0 and 11.35.1 are affected by CVE-2024-13918.
5
What should I do if I cannot upgrade to a secure version for CVE-2024-13918?
If unable to upgrade, consider disabling debug mode to mitigate the risk associated with CVE-2024-13918.