GHSA-6v7p-5qcq-268c
GHSA-6v7p-5qcq-268c · Zend-Navigation vulnerable to Cross-site Scripting
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Many Zend Framework 2 view helpers were using the `escapeHtml()` view helper in order to escape HTML attributes, instead of the more appropriate `escapeHtmlAttr()`. In situations where user data and/or JavaScript is used to seed attributes, this can lead to potential cross site scripting (XSS) attack vectors. Vulnerable view helpers include: - All `Zend\Form` view helpers. - Most `Zend\Navigation` (aka `Zend\View\Helper\Navigation\*`) view helpers. - All "HTML Element" view helpers: `htmlFlash()`, `htmlPage()`, `htmlQuickTime()`. - `Zend\View\Helper\Gravatar`
CVSS 7.5 · Alta · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: php
Productos y versiones afectados
zendframework/zend-navigation Packagist
- Versiones
- 2.0.3
- 2.0.4
- 2.0.5
- 2.0.6
- 2.0.7
- 2.0.8
- 2.1.0
- 2.1.1
- 2.1.2
- 2.1.3
- 2.1.4
- 2.1.5
- 2.1.6
- 2.2.0
- 2.2.0rc1
- 2.2.0rc2
- 2.2.0rc3
- 2.2.1
- 2.2.2
- 2.2.3
- 2.2.4
- 2.2.5
- 2.2.6
- Intervalos de versiones afectados
- ECOSYSTEM: ≥ 2.0.0, < 2.2.7
Actualiza a 2.2.7
zendframework/zend-navigation Packagist
- Versiones
- 2.3.0
- Intervalos de versiones afectados
- ECOSYSTEM: ≥ 2.3.0, < 2.3.1
Actualiza a 2.3.1