GHSA-hg35-vqp3-fv39
GHSA-hg35-vqp3-fv39 · ZendFramework potential Cross-site Scripting vectors due to inconsistent encodings
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
A number of classes, primarily within the `Zend_Form`, `Zend_Filter`, `Zend_Form`, `Zend_Log` and `Zend_View components`, contained character encoding inconsistencies whereby calls to the `htmlspecialchars()` and htmlentities() functions used undefined or hard coded charset parameters. In many of these cases developers were unable to set a character encoding of their choice. These inconsistencies could, in specific circumstances, allow certain multibyte representations of special HTML characters pass through unescaped leaving applications potentially vulnerable to cross-site scripting (XSS) exploits. Such exploits would only be possible if a developer used a non-typical character encoding (such as UTF-7), allowed users to define the character encoding, or served HTML documents without a valid character set defined.
CVSS 6.1 · Moyenne · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: php
Produits et versions concernés
zendframework/zendframework1 Packagist
- Plages de versions concernées
- ECOSYSTEM: ≥ 1.9.0, < 1.9.7
Mettez à jour vers 1.9.7