CVE-2024-47817CWE-79

Unvalidated paragraph widget values can be used for Cross-site Scripting in lara-zeus

Medium · published October 7, 2024

CVSS v4.0
5.3
EPSS
0%
Percentile
32.6
In the wild
Unconfirmed
What it is

Lara-zeus Dynamic Dashboard simple way to manage widgets for your website landing page, and filament dashboard and Lara-zeus artemis is a collection of themes for the lara-zeus ecosystem. If values passed to a paragraph widget are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a paragraph widget is rendered. Users are advised to upgrade to the appropriate fix versions detailed in the advisory metadata. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00395 · 32.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-10-07T21:22Z
EPSS history
Timeline
  • 07 OCT 21:22Z
    Unvalidated paragraph widget values can be used for Cross-site Scripting in lara-zeus
    cvelistv5