CVE-2022-23598: falha de média gravidade em laminas-form
Reflected XSS vulnerability when rendering error messages in laminas-form
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.1epss 1.0%
laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the `formElementErrors()` view helper. More information about this workaround is available on the GitHub Security Advisory.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
laminas · laminas-formReferências
https://getlaminas.org/security/advisory/LP-2022-01https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFF6WJ5I7PSEBRF6I753WKE2BXFBGQXE/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLNABVK26CE4PFL57VLY242FW3QY4CPC/