CVE-2022-31114

Name of the Vulnerable Software and Affected Versions backpack/crud versions prior to 5.0.13 backpack/crud versions prior to 4.1.69 backpack/crud versions prior to 4.0.63

Description Reflected Cross-Site Scripting (XSS) occurs because error views output the exception message without escaping it. An attacker could conduct a targeted phishing campaign to trick users or administrators into clicking a malicious link, which under specific circumstances could lead to information disclosure or unauthorized administrative access.

Recommendations For versions prior to 5.0.13, 4.1.69, and 4.0.63, update the package via composer update backpack/crud and run the php artisan backpack:fix command to patch published error views. As a temporary workaround, manually edit error views in resources/views/errors to output e($exception->getMessage()) instead of $exception->getMessage().