CVE-2022-23598 Reflected XSS vulnerability when rendering error messages in laminas-form

2022-01-2822:00:16

CWE-79

GitHub_M

www.cve.org

laminas-form

validation

error messages

xss

vulnerability

html contexts

patch

workaround

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.002

Percentile

60.0%

JSON

laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the formElementErrors() view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the formElementErrors() view helper. More information about this workaround is available on the GitHub Security Advisory.

CNA Affected

[
  {
    "product": "laminas-form",
    "vendor": "laminas",
    "versions": [
      {
        "status": "affected",
        "version": "< 3.1.1"
      }
    ]
  }
]