Login Request a demo
Medium severity · published Sep 27, 2024
CVE-2024-47186
Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
Filament is a collection of full-stack components for Laravel development. Versions of Filament from v3.0.0 through v3.2.114 are affected by a cross-site scripting (XSS) vulnerability. If values passed to a `ColorColumn` or `ColumnEntry` are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a color column or entry is rendered. Filament v3.2.115 fixes this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
filament · filamentphp
>= 3.0.0, < 3.2.115 · source: vendor, NVD
Affected product
FI
filament
filamentphp
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-47186
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-47186
Patch
https://github.com/filamentphp/filament/commit/df7989352464d08eda5837ef50f9997fad902316
Release Notes
https://github.com/filamentphp/filament/releases/tag/v3.2.115
Vendor Advisory
https://github.com/filamentphp/filament/security/advisories/GHSA-9h9q-qhxg-89xr
More from filament
8.1
CVE-2026-77567
Filament: App-based MFA can be bypassed when recovery codes are enabled
8.1
CVE-2025-67507
Filament's multi-factor authentication (app) recovery codes can be used multiple times
7.6
CVE-2026-55409
Filament: Disabled RichEditor field state can be used for XSS
7.4
CVE-2026-48505
Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission
6.5
CVE-2026-84306
Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used