GitHub Advisoryadvisory · Packagist

GHSA-5gmf-3c43-q73v ZendFramework vulnerable to Cross-site Scripting

MEDIUM Published 2024-06-07 Modified 2024-06-07 Official page ↗
Ecosystem
Packagist
Packages
zendframework/zendframework
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-06-07

Affected packages

• Packagist zendframework/zendframework: >= 2.0.0, < 2.0.1 → fixed in 2.0.1

Description

`Zend\Debug`, `Zend\Feed\PubSubHubbub`, `Zend\Log\Formatter\Xml`, `Zend\Tag\Cloud\Decorator`, `Zend\Uri`, `Zend\View\Helper\HeadStyle, Zend\View\Helper\Navigation\Sitemap`, and `Zend\View\Helper\Placeholder\Container\AbstractStandalone` were not using `Zend\Escaper` when escaping HTML, HTML attributes, and/or URLs. While most were performing some escaping, because they were not using context-appropriate escaping mechanisms, they could potentially be exploited to perform Cross Site Scripting (XSS) attacks.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References