https://seclists.org/oss-sec/2025/q1/196: [SBA-ADV-20241209-02] CVE-2024-13919: Laravel 11.9.0-11.35.1 flected XSS via Route Parameter in Debug-Mode Error Page
Published Mar 10, 2025
·Updated
Affected Software
1 affected component
Laravel Laravel Framework>=11.9.0<=11.35.1
Frequently Asked Questions
1
What is the severity of CVE-2024-13919?
CVE-2024-13919 is considered a high severity vulnerability due to the potential for reflected cross-site scripting (XSS) attacks.
2
How do I fix CVE-2024-13919?
To fix CVE-2024-13919, update your Laravel framework to version 11.36.0 or later where the vulnerability has been addressed.
3
What is the impact of CVE-2024-13919 on web applications?
The impact of CVE-2024-13919 allows an attacker to perform XSS attacks which can lead to session hijacking, defacement, or data leakage.
4
What conditions trigger CVE-2024-13919?
CVE-2024-13919 is triggered when the application is running in debug mode and accepts user-controlled route parameters without proper sanitization.
5
Is CVE-2024-13919 specific to certain Laravel versions?
Yes, CVE-2024-13919 specifically affects Laravel versions 11.9.0 through 11.35.1.