CVE-2022-23598: Reflected XSS vulnerability when rendering error messages in laminas-form
laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the formElementErrors() view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the formElementErrors() view helper. More information about this workaround is available on the GitHub Security Advisory.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-23598?
CVE-2022-23598 is a vulnerability in the laminas-form package that allows rendered validation error messages to contain the submitted value.
How can I exploit CVE-2022-23598?
As a user, you cannot directly exploit CVE-2022-23598, but an attacker could potentially use the vulnerability to gain information about the submitted values in validation error messages.
What is the severity of CVE-2022-23598?
The severity of CVE-2022-23598 is medium, with a CVSS score of 6.1.
What software versions are affected by CVE-2022-23598?
Versions up to and including 2.17.1 of Getlaminas Laminas-form, versions 3.0.0 to 3.0.2 of Getlaminas Laminas-form, and version 3.1.0 of Getlaminas Laminas-form are affected. Also, Fedora 34 and Fedora 35 are affected.
How do I fix CVE-2022-23598?
To fix CVE-2022-23598, update to version 3.1.1 or later of Getlaminas Laminas-form package.