Lucene search
Veracode Vulnerability DatabaseVERACODE:33966HistoryJan 31, 2022 - 7:03 a.m.
Cross-site Scripting (XSS)
2022-01-3107:03:51
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
8
laminas-form
xss
validation error
javascript
remote attacker
EPSS
0.002
Percentile
60.0%
laminas/laminas-form is vulnerable to cross-site scripting (XSS) attacks. A remote unauthenticated attacker is able to inject and execute malicious javascript on victim’s browser through the unescaped submitted values when rendering validation error messages via the formElementErrors function.
References
getlaminas.org/security/advisory/LP-2022-01
github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37
github.com/laminas/laminas-form/pull/161
github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375
lists.fedoraproject.org/archives/list/[email protected]/message/CFF6WJ5I7PSEBRF6I753WKE2BXFBGQXE/
lists.fedoraproject.org/archives/list/[email protected]/message/SLNABVK26CE4PFL57VLY242FW3QY4CPC/
Related
fedora
fedora
[SECURITY] Fedora 35 Update: php-laminas-form-2.17.1-1.fc35
2022-02-10 01:31:55
[SECURITY] Fedora 34 Update: php-laminas-form-2.17.1-1.fc34
2022-02-10 01:16:22
osv
osv
Cross-site Scripting when rendering error messages in laminas-form
2022-01-28 23:08:29
CVE-2022-23598
2022-01-28 22:15:16
openvas
openvas
Fedora: Security Advisory for php-laminas-form (FEDORA-2022-a42e97d8e8)
2022-02-10 00:00:00
Fedora: Security Advisory for php-laminas-form (FEDORA-2022-c138fbb8e0)
2022-02-10 00:00:00
nvd
nvd
CVE-2022-23598
2022-01-28 22:15:16
cvelist
cvelist
prion
prion
Cross site scripting
2022-01-28 22:15:00
github
github
Cross-site Scripting when rendering error messages in laminas-form
2022-01-28 23:08:29
cve
cve
CVE-2022-23598
2022-01-28 22:15:16