ZendFramework potential Cross-site Scripting vector in `Zend_Dojo_View_Helper_Editor`

2024-06-0721:11:29

CWE-79

GitHub Advisory Database

github.com

zendframework

potential

xss

security risk

rich text editor

7.1 High

AI Score

Confidence

High

JSON

Zend_Dojo_View_Helper_Editor was incorrectly decorating a TEXTAREA instead of a DIV. The Dojo team has reported that this has security implications as the rich text editor they use is unable to escape content for a TEXTAREA.

Affected configurations

Vulners

Node

zendframeworkzendframework1Range<1.9.7

zendframeworkzendframework1Range<1.8.5

zendframeworkzendframework1Range<1.7.9

CPENameOperatorVersion
zendframework/zendframework1lt1.9.7
zendframework/zendframework1lt1.8.5
zendframework/zendframework1lt1.7.9

Name	Operator	Version
zendframework/zendframework1	lt	1.9.7
zendframework/zendframework1	lt	1.8.5
zendframework/zendframework1	lt	1.7.9

References

framework.zend.com/security/advisory/ZF2010-02

github.com/advisories/GHSA-j543-vg33-g6vj

github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2010-02.yaml

7.1 High

AI Score

Confidence

High

JSON