diff --git a/advisories/unreviewed/2025/03/GHSA-546h-56qp-8jmw/GHSA-546h-56qp-8jmw.json b/advisories/github-reviewed/2025/03/GHSA-546h-56qp-8jmw/GHSA-546h-56qp-8jmw.json similarity index 56% rename from advisories/unreviewed/2025/03/GHSA-546h-56qp-8jmw/GHSA-546h-56qp-8jmw.json rename to advisories/github-reviewed/2025/03/GHSA-546h-56qp-8jmw/GHSA-546h-56qp-8jmw.json index 88f1d678221..b3882353cfc 100644 --- a/advisories/unreviewed/2025/03/GHSA-546h-56qp-8jmw/GHSA-546h-56qp-8jmw.json +++ b/advisories/github-reviewed/2025/03/GHSA-546h-56qp-8jmw/GHSA-546h-56qp-8jmw.json @@ -1,19 +1,40 @@ { "schema_version": "1.4.0", "id": "GHSA-546h-56qp-8jmw", - "modified": "2025-03-10T18:31:56Z", + "modified": "2025-03-10T20:21:10Z", "published": "2025-03-10T12:30:55Z", "aliases": [ "CVE-2024-13918" ], + "summary": "Laravel framework susceptible to reflected cross-site scripting", "details": "The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.", "severity": [ { "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N" + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L:/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "laravel/framework" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "11.36.0" + } + ] + } + ] } ], - "affected": [], "references": [ { "type": "ADVISORY", @@ -23,6 +44,14 @@ "type": "WEB", "url": "https://github.com/laravel/framework/pull/53869" }, + { + "type": "WEB", + "url": "https://github.com/laravel/framework/commit/45287fb2a91c69bb1c110539b9b7341faf5aee33" + }, + { + "type": "PACKAGE", + "url": "https://github.com/laravel/framework" + }, { "type": "WEB", "url": "https://github.com/laravel/framework/releases/tag/v11.36.0" @@ -40,9 +69,9 @@ "cwe_ids": [ "CWE-79" ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-10T20:21:10Z", "nvd_published_at": "2025-03-10T10:15:10Z" } } \ No newline at end of file