CVE-2012-4451
CVE-2012-4451
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.
CVSS 6.1 · Medium · EPSS 1.4%
- Published
- Updated
Stack: system
Affected products and versions
zend framework
- Versions
- 2.0.x before 2.0.1: Affected
No fix published
zend-framework Ubuntu:16.04:LTS
- Versions
- 1.11.11-0ubuntu2
- 1.11.11-0ubuntu3
- 1.11.11-0ubuntu3.16.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688946#10
- https://bugs.gentoo.org/show_bug.cgi?id=436210
- http://seclists.org/oss-sec/2012/q3/571
- http://seclists.org/oss-sec/2012/q3/573
- http://framework.zend.com/security/advisory/ZF2012-03
- https://bugzilla.redhat.com/show_bug.cgi?id=860738
- https://github.com/zendframework/zf2/commit/27131ca9520bdf1d4c774c71459eba32f2b10733
- http://www.securityfocus.com/bid/55636
- https://nvd.nist.gov/vuln/detail/CVE-2012-4451