Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-47817

CVE-2024-47817: Lara-zeus Dynamic Dashboard and Artemis do not validate paragraph widget values which can be used for XSS

6.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-47817
GHSA ID
GHSA-c6cw-g7fc-4gwc
EPSS Score
0.06612%
CWE
CWE-79
Published
10/7/2024
Updated
10/8/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
lara-zeus/dynamic-dashboardcomposer>= 3.0.0, <= 3.0.13.0.2
lara-zeus/artemiscomposer>= 1.0.0, <= 1.0.61.0.7

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from unsanitized output in paragraph widget templates. Analysis of the patches shows:

  1. The fix added strip_tags() sanitization before markdown processing
  2. The original vulnerable code used {!! $data['content'] !!} directly
  3. Multiple theme implementations (zeus, breeze, daisy) were patched similarly
  4. The {!! !!} syntax in Laravel Blade prevents automatic HTML escaping
  5. CWE-79 classification confirms this is a classic XSS scenario through unvalidated user input in templates

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

# Summ*ry I* v*lu*s p*ss** to * p*r**r*p* wi***t *r* not v*li* *n* *ont*in * sp**i*i* s*t o* ***r**t*rs, *ppli**tions *r* vuln*r**l* to XSS *tt**k ***inst * us*r w*o op*ns * p*** on w*i** * p*r**r*p* wi***t is r*n**r**. V*rsions o* *yn*mi* **s**o*r*

Reasoning

T** vuln*r**ility st*ms *rom uns*nitiz** output in p*r**r*p* wi***t t*mpl*t*s. *n*lysis o* t** p*t***s s*ows: *. T** *ix ***** strip_t**s() s*nitiz*tion ***or* m*rk*own pro**ssin* *. T** ori*in*l vuln*r**l* *o** us** {!! $**t*['*ont*nt'] !!} *ir**tly