GHSA-4vf6-mq7w-3hp6 json
Zend_Filter_StripTags vulnerable to Cross-site Scripting when comments allowed
published 2y ago modified 2y ago
- cvss
- 6.1
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
Zend_Filter_StripTags contained an optional setting to allow whitelisting HTML comments in filtered text. Microsoft Internet Explorer and several other browsers allow developers to create conditional functionality via HTML comments, including execution of script events and rendering of additional commented markup. By allowing whitelisting of HTML comments, a malicious user could potentially include XSS exploits within HTML comments that would then be rendered in the final output.
Patch / fix
- packagist zendframework/zendframework1 1.7.9, 1.8.5, 1.9.7
Is GHSA-4vf6-mq7w-3hp6 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | zendframework/zendframework1 | >=1.7.0, <1.7.9 >=1.8.0, <1.8.5 >=1.9.0, <1.9.7 |
1.7.9 1.8.5 1.9.7 |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
Sources
- GitHub Advisory GHSA-4vf6-mq7w-3hp6
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.