CVE-2024-13919: Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page
Published Mar 10, 2025
·Updated
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page.
Affected Software
3 affected componentsFixes available
Laravel Laravel Framework>=11.9.0<=11.35.1
composer/laravel/framework>=11.9.0<11.36.0
11.36.0
Laravel Framework>=11.9.0<11.36.0
Remediation
Information
Update to version 11.36.0 or later.
Patch Available
Event History
Mar 10, 2025
CVE Published
via MITRE·10:03 AM
Data Sourced
via MITRE·10:03 AM
RemedyDescriptionSeverityWeakness
Advisory Published
via GitHub·12:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-13919?
CVE-2024-13919 has been classified as critical due to its potential to allow reflected cross-site scripting attacks.
2
How do I fix CVE-2024-13919?
To fix CVE-2024-13919, upgrade your Laravel framework to version 11.36.0 or higher.
3
Which Laravel framework versions are affected by CVE-2024-13919?
CVE-2024-13919 affects Laravel framework versions from 11.9.0 to 11.35.1.
4
What type of vulnerability is CVE-2024-13919?
CVE-2024-13919 is a reflected cross-site scripting vulnerability.
5
What causes the vulnerability in CVE-2024-13919?
The vulnerability in CVE-2024-13919 is caused by improper encoding of route parameters in the debug-mode error page.