PT-2024-40307 · Zend · Zend Framework 2

Published 2024-06-07 · Updated 2024-06-07

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zend Framework 2 (affected versions not specified)

Description The issue arises from the use of the escapeHtml() view helper instead of the more suitable escapeHtmlAttr() to escape HTML attributes in various Zend Framework 2 view helpers. This can lead to potential cross-site scripting (XSS) attack vectors, particularly when user data and/or JavaScript are used to seed attributes. The affected view helpers include all ZendForm view helpers, most ZendNavigation view helpers, all "HTML Element" view helpers such as htmlFlash(), htmlPage(), htmlQuickTime(), and ZendViewHelperGravatar.

Recommendations For all affected versions, consider updating the view helpers to use escapeHtmlAttr() instead of escapeHtml() to properly escape HTML attributes and mitigate the risk of XSS attacks. As a temporary workaround, consider restricting user input and validating data used in HTML attributes to minimize the risk of exploitation. Avoid using user data and/or JavaScript to seed attributes in the affected view helpers until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-GVPP-6JRJ-5PQC

Affected Products

Zend Framework 2

References · 7

• https://osv.dev/vulnerability/GHSA-gvpp-6jrj-5pqc · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-form/ZF2014-03.yaml · Note
• https://github.com/zendframework/zend-form/commit/fd43a951460c4bc60c77a566129705f6bdb9c61b · Note
• https://github.com/zendframework/zend-form · Note
• https://github.com/zendframework/zend-form/commit/d7a1f5bc4626b1df990391502a868b28c37ba65d · Note
• https://github.com/zendframework/zend-form/commit/6fe40314e8e3477494aadd03d62573bd1c212bd1 · Note
• https://framework.zend.com/security/advisory/ZF2014-03 · Note