GHSA-hg35-vqp3-fv39
Suggest an improvement- Source
- https://github.com/advisories/GHSA-hg35-vqp3-fv39
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-hg35-vqp3-fv39/GHSA-hg35-vqp3-fv39.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-hg35-vqp3-fv39
- Published
- 2024-06-07T21:14:54Z
- Modified
- 2024-06-07T21:14:54Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- ZendFramework potential Cross-site Scripting vectors due to inconsistent encodings
- Details
-
A number of classes, primarily within the
Zend_Form,Zend_Filter,Zend_Form,Zend_LogandZend_View components, contained character encoding inconsistencies whereby calls to thehtmlspecialchars()and htmlentities() functions used undefined or hard coded charset parameters. In many of these cases developers were unable to set a character encoding of their choice. These inconsistencies could, in specific circumstances, allow certain multibyte representations of special HTML characters pass through unescaped leaving applications potentially vulnerable to cross-site scripting (XSS) exploits. Such exploits would only be possible if a developer used a non-typical character encoding (such as UTF-7), allowed users to define the character encoding, or served HTML documents without a valid character set defined. - Database specific
{ "nvd_published_at": null, "cwe_ids": [ "CWE-79" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-06-07T21:14:54Z" }- References
Affected packages
Packagist / zendframework/zendframework1
Package
- Name
- zendframework/zendframework1
- Purl
- pkg:composer/zendframework/zendframework1