What is GHSA-6gfm-gpr3-8wh9?

GHSA-6gfm-gpr3-8wh9 is a security advisory published by GitHub Security Advisories with Medium severity. Backpack\CRUD for Laravel XSS Vulnerability

Which CVE IDs does GHSA-6gfm-gpr3-8wh9 cover?

GHSA-6gfm-gpr3-8wh9 covers the following CVE IDs: CVE-2018-20962. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6gfm-gpr3-8wh9?

GHSA-6gfm-gpr3-8wh9 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-6gfm-gpr3-8wh9?

GHSA-6gfm-gpr3-8wh9 affects 1 product, including: composer/backpack/crud:\u003c 3.4.9.

GHSA-6gfm-gpr3-8wh9MediumCVSS 6.1

Backpack\CRUD for Laravel XSS Vulnerability

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

October 5, 2023

🔗 CVE IDs covered (1)

CVE-2018-20962 →

📋 Description

The Backpack\CRUD Backpack component before 3.4.9 for Laravel allows XSS via the select field type.

🎯 Affected products1

composer/backpack/crud:< 3.4.9

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2018-20962
https://github.com/Laravel-Backpack/CRUD/issues/1297
https://github.com/Laravel-Backpack/CRUD/commit/8b6bd0a2d489a4690f6b1d7ace67e2f07f5f0cc6
https://github.com/Laravel-Backpack/CRUD/compare/3.4.8...3.4.9
https://github.com/Laravel-Backpack/CRUD/blob/8b6bd0a2d489a4690f6b1d7ace67e2f07f5f0cc6/CHANGELOG.md?plain=1#L27
https://github.com/advisories/GHSA-6gfm-gpr3-8wh9