6.1

CVE-2012-4451

Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zend ≫ Zend Framework Version < 2.0.1
Fedoraproject ≫ Fedora Version16
Fedoraproject ≫ Fedora Version17
Redhat ≫ Enterprise Linux Version6.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.37% 0.683
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://framework.zend.com/security/advisory/ZF2012-03
Vendor Advisory
http://seclists.org/oss-sec/2012/q3/571
Patch
Third Party Advisory
Mailing List
http://seclists.org/oss-sec/2012/q3/573
Patch
Third Party Advisory
Mailing List
http://www.securityfocus.com/bid/55636
Third Party Advisory
VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688946#10
Third Party Advisory
Mailing List
https://bugs.gentoo.org/show_bug.cgi?id=436210
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=860738
Patch
Third Party Advisory
Issue Tracking
https://github.com/zendframework/zf2/commit/27131ca9520bdf1d4c774c71459eba32f2b10733
Patch
Third Party Advisory