GHSA-4v57-pwvf-x35j

Source

https://github.com/advisories/GHSA-4v57-pwvf-x35j

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-4v57-pwvf-x35j/GHSA-4v57-pwvf-x35j.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-4v57-pwvf-x35j

Published

2024-06-07T21:59:20Z

Modified

2024-06-07T21:59:20Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Zendframework potential Cross-site Scripting vector in `Zend_Service_ReCaptcha_MailHide`

Details

Zend_Service_ReCaptcha_MailHide had a potential XSS vulnerability. Due to the fact that the email address was never validated, and because its use of htmlentities() did not include the encoding argument, it was potentially possible for a malicious user aware of the issue to inject a specially crafted multibyte string as an attack via the CAPTCHA's email argument

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-07T21:59:20Z"
}

References

Affected packages

Packagist / zendframework/zendframework1

Package

Name: zendframework/zendframework1
Purl: pkg:composer/zendframework/zendframework1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.7.0

Fixed

1.7.9

Packagist / zendframework/zendframework1

Package

Name: zendframework/zendframework1
Purl: pkg:composer/zendframework/zendframework1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.8.0

Fixed

1.8.5

Packagist / zendframework/zendframework1

Package

Name: zendframework/zendframework1
Purl: pkg:composer/zendframework/zendframework1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.9.0

Fixed

1.9.7