livewire Cross-Site Request Forgery vulnerability · CVE-2024-22859 · GitHub Advisory Database · GitHub

livewire Cross-Site Request Forgery vulnerability

High severity GitHub Reviewed Published Feb 1, 2024 to the GitHub Advisory Database • Updated Feb 13, 2024

Withdrawn This advisory was withdrawn on Feb 13, 2024

Package

livewire/livewire (Composer)

Affected versions

>= 3.0.0, < 3.0.4

Patched versions

3.0.4

Description

Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken function.

References

Published by the National Vulnerability Database

Feb 1, 2024

Published to the GitHub Advisory Database Feb 1, 2024

Reviewed Feb 1, 2024

Withdrawn Feb 13, 2024

Last updated Feb 13, 2024

Severity

High

8.8

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H