CVE-2021-43808 (Medium) detected in laravel/framework-v5.5.49

[mend-bolt-for-github]

CVE-2021-43808 - Medium Severity Vulnerability

Vulnerable Library - laravel/framework-v5.5.49

The Laravel Framework.

Library home page: https://api.github.com/repos/laravel/framework/zipball/a81f23d0ccd2fefa7fa9b79649ab23811631d9bf

Dependency Hierarchy:

• orchestra/testbench-v3.5.5 (Root Library)
  • ❌ laravel/framework-v5.5.49 (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Laravel is a web application framework. Laravel prior to versions 8.75.0, 7.30.6, and 6.20.42 contain a possible cross-site scripting (XSS) vulnerability in the Blade templating engine. A broken HTML element may be clicked and the user taken to another location in their browser due to XSS. This is due to the user being able to guess the parent placeholder SHA-1 hash by trying common names of sections. If the parent template contains an exploitable HTML structure an XSS vulnerability can be exposed. This vulnerability has been patched in versions 8.75.0, 7.30.6, and 6.20.42 by determining the parent placeholder at runtime and using a random hash that is unique to each request.

Publish Date: 2021-12-08

URL: CVE-2021-43808

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-66hf-2p6w-jqfw

Release Date: 2021-12-08

Fix Resolution: v6.20.42, v7.30.6, v8.75.0

---

Step up your Open Source Security Game with Mend here