PT-2024-40084 · Zend · Zend Filter Striptags

Published 2024-06-07 · Updated 2024-06-07

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Zend Filter StripTags (affected versions not specified)

Description: The issue allows a malicious user to potentially include XSS exploits within HTML comments that would then be rendered in the final output, as Zend Filter StripTags contained an optional setting to allow whitelisting HTML comments in filtered text. This could be particularly problematic given that browsers like Microsoft Internet Explorer allow developers to create conditional functionality via HTML comments, including execution of script events and rendering of additional commented markup.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-4VF6-MQ7W-3HP6

Affected Products

Zend Filter Striptags

References · 4

• https://osv.dev/vulnerability/GHSA-4vf6-mq7w-3hp6 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2010-03.yaml · Note
• https://github.com/zendframework/zf1 · Note
• https://web.archive.org/web/20210411020019/https://framework.zend.com/security/advisory/ZF2010-03 · Note