CVE-2012-4451: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.
Other sources
Multiple possibilities for cross-site scripting (XSS) flaws were corrected in upstream 2.0.1 version of Zend Framework: [1] http://framework.zend.com/blog/zend-framework-2-0-1-released.html
More from upstream advisory - [2] http://framework.zend.com/security/advisory/ZF2012-03:
Zend\Debug, Zend\Feed\PubSubHubbub, Zend\Log\Formatter\Xml, Zend\Tag\Cloud\Decorator, Zend\Uri, Zend\View\Helper\HeadStyle, Zend\View\Helper\Navigation\Sitemap, and Zend\View\Helper\Placeholder\Container\AbstractStandalone were not using Zend\Escaper when escaping HTML, HTML attributes, and/or URLs. While most were performing some escaping, because they were not using context-appropriate escaping mechanisms, they could potentially be exploited to perform Cross Site Scripting (XSS) attacks.
Relevant upstream patch: [3] https://github.com/zendframework/zf2/commit/27131ca9520bdf1d4c774c71459eba32f2b10733
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4451?
The severity of CVE-2012-4451 is rated as medium with a score of 6.1.
How do I fix CVE-2012-4451?
To fix CVE-2012-4451, upgrade to Zend Framework version 2.0.1 or later.
What are the main issues caused by CVE-2012-4451?
CVE-2012-4451 allows remote attackers to inject arbitrary web script or HTML through multiple entry points.
Which versions of Zend Framework are affected by CVE-2012-4451?
CVE-2012-4451 affects Zend Framework versions prior to 2.0.1.
What is the nature of the vulnerabilities in CVE-2012-4451?
CVE-2012-4451 involves multiple cross-site scripting (XSS) vulnerabilities.