PT-2024-40200 · Zend · Zend Framework 2

Published 2024-06-07 · Updated 2024-06-07

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Zend Framework 2 (affected versions not specified)

Description: The issue arises from the use of the escapeHtml() view helper instead of the more appropriate escapeHtmlAttr() to escape HTML attributes in various Zend Framework 2 view helpers. This can lead to potential cross-site scripting (XSS) attack vectors when user data and/or JavaScript are used to seed attributes. The affected view helpers include all ZendForm view helpers, most ZendNavigation view helpers, all HTML Element view helpers such as htmlFlash(), htmlPage(), htmlQuickTime(), and ZendViewHelperGravatar.

Recommendations: For all affected versions, consider updating the view helpers to use escapeHtmlAttr() instead of escapeHtml() to properly escape HTML attributes and mitigate the risk of XSS attacks. As a temporary workaround, consider restricting the use of user data and/or JavaScript in seeding attributes for the affected view helpers until a proper update can be applied. Restrict access to the vulnerable view helpers to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-8Q77-CV62-JJ38

Affected Products

Zend Framework 2

References · 6

• https://osv.dev/vulnerability/GHSA-8q77-cv62-jj38 · Vendor Advisory
• https://github.com/zendframework/zendframework/commit/6742ddad7a7923163cea6dd58d27d0e946a402d1 · Note
• https://github.com/zendframework/zendframework/commit/1dd4f8cede07469390eef1e629f808349fa1b5ea · Note
• https://github.com/zendframework/zendframework · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/ZF2014-03.yaml · Note
• https://framework.zend.com/security/advisory/ZF2014-03 · Note