CVE-2022-23598
Reflected XSS vulnerability when rendering error messages in laminas-form
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the `formElementErrors()` view helper. More information about this workaround is available on the GitHub Security Advisory.
laminas-form es un paquete para la comprobación y visualización de formularios simples y complejos. Cuando son mostrados los mensajes de error de comprobación por medio del ayudante de vista "formElementErrors()" incluido en laminas-form, muchos mensajes contienen el valor enviado. Sin embargo, en laminas-form versiones anteriores a 3.1.1, el valor no es escapado para los contextos HTML, lo que potencialmente podía conllevar a un ataque de tipo Cross-site scripting reflejado. Las versiones 3.1.1 y superiores contienen un parche para mitigar la vulnerabilidad. Se presenta una solución disponible. Puede colocarse manualmente un código en la parte superior de un script de visualización donde es llamado al ayudante de visualización "formElementErrors()". Se presenta más información sobre esta medida de mitigación en el aviso de seguridad de GitHub
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-01-19 CVE Reserved
- 2022-01-28 CVE Published
- 2024-08-03 CVE Updated
- 2024-10-13 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://getlaminas.org/security/advisory/LP-2022-01 | Mitigation | |
| https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375 | Mitigation |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37 | 2023-11-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Getlaminas Search vendor "Getlaminas" | Laminas-form Search vendor "Getlaminas" for product "Laminas-form" | < 2.17.1 Search vendor "Getlaminas" for product "Laminas-form" and version " < 2.17.1" | - |
Affected
| ||||||
| Getlaminas Search vendor "Getlaminas" | Laminas-form Search vendor "Getlaminas" for product "Laminas-form" | >= 3.0.0 < 3.0.2 Search vendor "Getlaminas" for product "Laminas-form" and version " >= 3.0.0 < 3.0.2" | - |
Affected
| ||||||
| Getlaminas Search vendor "Getlaminas" | Laminas-form Search vendor "Getlaminas" for product "Laminas-form" | 3.1.0 Search vendor "Getlaminas" for product "Laminas-form" and version "3.1.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 34 Search vendor "Fedoraproject" for product "Fedora" and version "34" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 35 Search vendor "Fedoraproject" for product "Fedora" and version "35" | - |
Affected
| ||||||