Headline
GHSA-6v7p-5qcq-268c: Zend-Navigation vulnerable to Cross-site Scripting
Many Zend Framework 2 view helpers were using the escapeHtml() view helper in order to escape HTML attributes, instead of the more appropriate escapeHtmlAttr(). In situations where user data and/or JavaScript is used to seed attributes, this can lead to potential cross site scripting (XSS) attack vectors.
Vulnerable view helpers include:
- All
Zend\Formview helpers. - Most
Zend\Navigation(akaZend\View\Helper\Navigation\*) view helpers. - All “HTML Element” view helpers:
htmlFlash(),htmlPage(),htmlQuickTime(). Zend\View\Helper\Gravatar
- GitHub Advisory Database
- GitHub Reviewed
- GHSA-6v7p-5qcq-268c
Zend-Navigation vulnerable to Cross-site Scripting
High severity GitHub Reviewed Published Jun 7, 2024 to the GitHub Advisory Database • Updated Jun 7, 2024
Package
composer zendframework/zend-navigation (Composer)
Affected versions
>= 2.0.0, < 2.2.7
>= 2.3.0, < 2.3.1
Patched versions
2.2.7
2.3.1
Published to the GitHub Advisory Database
Jun 7, 2024