CVE-2024-22859

published 2024-02-01

CVE-2024-22859: Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken function. NOTE: the…

Priority P3 44 high 8.8 CVSS 3.1

AV N AC L PR N UI R S U C H I H A H

Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken function. NOTE: the vendor disputes this because the 5d88731 commit fixes a usability problem (HTTP 419 status codes for legitimate client activity), not a security problem.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
laravel	livewire	< 3.0.4	3.0.4
livewire	livewire	>= 3.0.0 < 3.0.4	3.0.4

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-352