cvelistv5 - cve-2022-23598

CVE-2022-23598 (GCVE-0-2022-23598)

Vulnerability from cvelistv5 – Published: 2022-01-28 22:00 – Updated: 2025-04-23 19:08

Summary

laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the `formElementErrors()` view helper. More information about this workaround is available on the GitHub Security Advisory.

Severity ?

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/laminas/laminas-form/security/…	x_refsource_CONFIRM
	https://github.com/laminas/laminas-form/commit/43…	x_refsource_MISC
	https://getlaminas.org/security/advisory/LP-2022-01	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA

Impacted products

	Vendor	Product	Version
	laminas	laminas-form	Affected: < 3.1.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:43:46.896Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://getlaminas.org/security/advisory/LP-2022-01"
          },
          {
            "name": "FEDORA-2022-a42e97d8e8",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLNABVK26CE4PFL57VLY242FW3QY4CPC/"
          },
          {
            "name": "FEDORA-2022-c138fbb8e0",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFF6WJ5I7PSEBRF6I753WKE2BXFBGQXE/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-23598",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T14:11:31.706121Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T19:08:45.281Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "laminas-form",
          "vendor": "laminas",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the `formElementErrors()` view helper. More information about this workaround is available on the GitHub Security Advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-10T03:06:23.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://getlaminas.org/security/advisory/LP-2022-01"
        },
        {
          "name": "FEDORA-2022-a42e97d8e8",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLNABVK26CE4PFL57VLY242FW3QY4CPC/"
        },
        {
          "name": "FEDORA-2022-c138fbb8e0",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFF6WJ5I7PSEBRF6I753WKE2BXFBGQXE/"
        }
      ],
      "source": {
        "advisory": "GHSA-jq4p-mq33-w375",
        "discovery": "UNKNOWN"
      },
      "title": "Reflected XSS vulnerability when rendering error messages in laminas-form",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-23598",
          "STATE": "PUBLIC",
          "TITLE": "Reflected XSS vulnerability when rendering error messages in laminas-form"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "laminas-form",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 3.1.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "laminas"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the `formElementErrors()` view helper. More information about this workaround is available on the GitHub Security Advisory."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375",
              "refsource": "CONFIRM",
              "url": "https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375"
            },
            {
              "name": "https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37",
              "refsource": "MISC",
              "url": "https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37"
            },
            {
              "name": "https://getlaminas.org/security/advisory/LP-2022-01",
              "refsource": "MISC",
              "url": "https://getlaminas.org/security/advisory/LP-2022-01"
            },
            {
              "name": "FEDORA-2022-a42e97d8e8",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SLNABVK26CE4PFL57VLY242FW3QY4CPC/"
            },
            {
              "name": "FEDORA-2022-c138fbb8e0",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CFF6WJ5I7PSEBRF6I753WKE2BXFBGQXE/"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-jq4p-mq33-w375",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-23598",
    "datePublished": "2022-01-28T22:00:16.000Z",
    "dateReserved": "2022-01-19T00:00:00.000Z",
    "dateUpdated": "2025-04-23T19:08:45.281Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:getlaminas:laminas-form:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.17.1\", \"matchCriteriaId\": \"87A945AD-C8D8-4BF9-AEFE-AB8F1018484D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:getlaminas:laminas-form:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.0.0\", \"versionEndExcluding\": \"3.0.2\", \"matchCriteriaId\": \"44B054C5-A156-47EC-AAD5-7AC4A6E9460E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:getlaminas:laminas-form:3.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"98097242-DBA4-4D6A-8BD5-7263E1E06D3B\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A930E247-0B43-43CB-98FF-6CE7B8189835\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"80E516C0-98A4-4ADE-B69F-66A772E2BAAA\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the `formElementErrors()` view helper. More information about this workaround is available on the GitHub Security Advisory.\"}, {\"lang\": \"es\", \"value\": \"laminas-form es un paquete para la comprobaci\\u00f3n y visualizaci\\u00f3n de formularios simples y complejos. Cuando son mostrados los mensajes de error de comprobaci\\u00f3n por medio del ayudante de vista \\\"formElementErrors()\\\" incluido en laminas-form, muchos mensajes contienen el valor enviado. Sin embargo, en laminas-form versiones anteriores a 3.1.1, el valor no es escapado para los contextos HTML, lo que potencialmente pod\\u00eda conllevar a un ataque de tipo Cross-site scripting reflejado. Las versiones 3.1.1 y superiores contienen un parche para mitigar la vulnerabilidad. Se presenta una soluci\\u00f3n disponible. Puede colocarse manualmente un c\\u00f3digo en la parte superior de un script de visualizaci\\u00f3n donde es llamado al ayudante de visualizaci\\u00f3n \\\"formElementErrors()\\\". Se presenta m\\u00e1s informaci\\u00f3n sobre esta medida de mitigaci\\u00f3n en el aviso de seguridad de GitHub\"}]",
      "id": "CVE-2022-23598",
      "lastModified": "2024-11-21T06:48:53.950",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"baseScore\": 6.1, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 2.7}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"baseScore\": 6.1, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 2.7}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:N/I:P/A:N\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2022-01-28T22:15:16.770",
      "references": "[{\"url\": \"https://getlaminas.org/security/advisory/LP-2022-01\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Mitigation\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Mitigation\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFF6WJ5I7PSEBRF6I753WKE2BXFBGQXE/\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLNABVK26CE4PFL57VLY242FW3QY4CPC/\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://getlaminas.org/security/advisory/LP-2022-01\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mitigation\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mitigation\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFF6WJ5I7PSEBRF6I753WKE2BXFBGQXE/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLNABVK26CE4PFL57VLY242FW3QY4CPC/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-23598\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2022-01-28T22:15:16.770\",\"lastModified\":\"2024-11-21T06:48:53.950\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the `formElementErrors()` view helper. More information about this workaround is available on the GitHub Security Advisory.\"},{\"lang\":\"es\",\"value\":\"laminas-form es un paquete para la comprobaci\u00f3n y visualizaci\u00f3n de formularios simples y complejos. Cuando son mostrados los mensajes de error de comprobaci\u00f3n por medio del ayudante de vista \\\"formElementErrors()\\\" incluido en laminas-form, muchos mensajes contienen el valor enviado. Sin embargo, en laminas-form versiones anteriores a 3.1.1, el valor no es escapado para los contextos HTML, lo que potencialmente pod\u00eda conllevar a un ataque de tipo Cross-site scripting reflejado. Las versiones 3.1.1 y superiores contienen un parche para mitigar la vulnerabilidad. Se presenta una soluci\u00f3n disponible. Puede colocarse manualmente un c\u00f3digo en la parte superior de un script de visualizaci\u00f3n donde es llamado al ayudante de visualizaci\u00f3n \\\"formElementErrors()\\\". Se presenta m\u00e1s informaci\u00f3n sobre esta medida de mitigaci\u00f3n en el aviso de seguridad de GitHub\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:getlaminas:laminas-form:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.17.1\",\"matchCriteriaId\":\"87A945AD-C8D8-4BF9-AEFE-AB8F1018484D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:getlaminas:laminas-form:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0.0\",\"versionEndExcluding\":\"3.0.2\",\"matchCriteriaId\":\"44B054C5-A156-47EC-AAD5-7AC4A6E9460E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:getlaminas:laminas-form:3.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"98097242-DBA4-4D6A-8BD5-7263E1E06D3B\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A930E247-0B43-43CB-98FF-6CE7B8189835\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"80E516C0-98A4-4ADE-B69F-66A772E2BAAA\"}]}]}],\"references\":[{\"url\":\"https://getlaminas.org/security/advisory/LP-2022-01\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFF6WJ5I7PSEBRF6I753WKE2BXFBGQXE/\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLNABVK26CE4PFL57VLY242FW3QY4CPC/\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://getlaminas.org/security/advisory/LP-2022-01\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFF6WJ5I7PSEBRF6I753WKE2BXFBGQXE/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLNABVK26CE4PFL57VLY242FW3QY4CPC/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://getlaminas.org/security/advisory/LP-2022-01\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLNABVK26CE4PFL57VLY242FW3QY4CPC/\", \"name\": \"FEDORA-2022-a42e97d8e8\", \"tags\": [\"vendor-advisory\", \"x_refsource_FEDORA\", \"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFF6WJ5I7PSEBRF6I753WKE2BXFBGQXE/\", \"name\": \"FEDORA-2022-c138fbb8e0\", \"tags\": [\"vendor-advisory\", \"x_refsource_FEDORA\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T03:43:46.896Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-23598\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-23T14:11:31.706121Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-23T14:11:32.995Z\"}}], \"cna\": {\"title\": \"Reflected XSS vulnerability when rendering error messages in laminas-form\", \"source\": {\"advisory\": \"GHSA-jq4p-mq33-w375\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"laminas\", \"product\": \"laminas-form\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 3.1.1\"}]}], \"references\": [{\"url\": \"https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://getlaminas.org/security/advisory/LP-2022-01\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLNABVK26CE4PFL57VLY242FW3QY4CPC/\", \"name\": \"FEDORA-2022-a42e97d8e8\", \"tags\": [\"vendor-advisory\", \"x_refsource_FEDORA\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFF6WJ5I7PSEBRF6I753WKE2BXFBGQXE/\", \"name\": \"FEDORA-2022-c138fbb8e0\", \"tags\": [\"vendor-advisory\", \"x_refsource_FEDORA\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the `formElementErrors()` view helper. More information about this workaround is available on the GitHub Security Advisory.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2022-02-10T03:06:23.000Z\"}, \"x_legacyV4Record\": {\"impact\": {\"cvss\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}, \"source\": {\"advisory\": \"GHSA-jq4p-mq33-w375\", \"discovery\": \"UNKNOWN\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"version_value\": \"\u003c 3.1.1\"}]}, \"product_name\": \"laminas-form\"}]}, \"vendor_name\": \"laminas\"}]}}, \"data_type\": \"CVE\", \"references\": {\"reference_data\": [{\"url\": \"https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375\", \"name\": \"https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375\", \"refsource\": \"CONFIRM\"}, {\"url\": \"https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37\", \"name\": \"https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37\", \"refsource\": \"MISC\"}, {\"url\": \"https://getlaminas.org/security/advisory/LP-2022-01\", \"name\": \"https://getlaminas.org/security/advisory/LP-2022-01\", \"refsource\": \"MISC\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SLNABVK26CE4PFL57VLY242FW3QY4CPC/\", \"name\": \"FEDORA-2022-a42e97d8e8\", \"refsource\": \"FEDORA\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CFF6WJ5I7PSEBRF6I753WKE2BXFBGQXE/\", \"name\": \"FEDORA-2022-c138fbb8e0\", \"refsource\": \"FEDORA\"}]}, \"data_format\": \"MITRE\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the `formElementErrors()` view helper. More information about this workaround is available on the GitHub Security Advisory.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}]}, \"data_version\": \"4.0\", \"CVE_data_meta\": {\"ID\": \"CVE-2022-23598\", \"STATE\": \"PUBLIC\", \"TITLE\": \"Reflected XSS vulnerability when rendering error messages in laminas-form\", \"ASSIGNER\": \"security-advisories@github.com\"}}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-23598\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-23T19:08:45.281Z\", \"dateReserved\": \"2022-01-19T00:00:00.000Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2022-01-28T22:00:16.000Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GSD-2022-23598

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2022-23598

Aliases

CVE-2022-23598

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-23598",
    "description": "laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the `formElementErrors()` view helper. More information about this workaround is available on the GitHub Security Advisory.",
    "id": "GSD-2022-23598"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-23598"
      ],
      "details": "laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the `formElementErrors()` view helper. More information about this workaround is available on the GitHub Security Advisory.",
      "id": "GSD-2022-23598",
      "modified": "2023-12-13T01:19:34.998894Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2022-23598",
        "STATE": "PUBLIC",
        "TITLE": "Reflected XSS vulnerability when rendering error messages in laminas-form"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "laminas-form",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003c 3.1.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "laminas"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the `formElementErrors()` view helper. More information about this workaround is available on the GitHub Security Advisory."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375",
            "refsource": "CONFIRM",
            "url": "https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375"
          },
          {
            "name": "https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37",
            "refsource": "MISC",
            "url": "https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37"
          },
          {
            "name": "https://getlaminas.org/security/advisory/LP-2022-01",
            "refsource": "MISC",
            "url": "https://getlaminas.org/security/advisory/LP-2022-01"
          },
          {
            "name": "FEDORA-2022-a42e97d8e8",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SLNABVK26CE4PFL57VLY242FW3QY4CPC/"
          },
          {
            "name": "FEDORA-2022-c138fbb8e0",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CFF6WJ5I7PSEBRF6I753WKE2BXFBGQXE/"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-jq4p-mq33-w375",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c3.1.1",
          "affected_versions": "All versions before 3.1.1",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2022-01-28",
          "description": "laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the `formElementErrors()` view helper.",
          "fixed_versions": [
            "3.1.1"
          ],
          "identifier": "CVE-2022-23598",
          "identifiers": [
            "GHSA-jq4p-mq33-w375",
            "CVE-2022-23598"
          ],
          "not_impacted": "All versions starting from 3.1.1",
          "package_slug": "packagist/laminas/laminas-form",
          "pubdate": "2022-01-28",
          "solution": "Upgrade to version 3.1.1 or above.",
          "title": "Reflected XSS vulnerability when rendering error messages in laminas-form",
          "urls": [
            "https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375",
            "https://github.com/advisories/GHSA-jq4p-mq33-w375"
          ],
          "uuid": "99363a5f-254b-4c94-9e74-ecd9bc7ba6af"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:getlaminas:laminas-form:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.17.1",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:getlaminas:laminas-form:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "3.0.2",
                "versionStartIncluding": "3.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:getlaminas:laminas-form:3.1.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-23598"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the `formElementErrors()` view helper. More information about this workaround is available on the GitHub Security Advisory."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://getlaminas.org/security/advisory/LP-2022-01",
              "refsource": "MISC",
              "tags": [
                "Mitigation",
                "Third Party Advisory"
              ],
              "url": "https://getlaminas.org/security/advisory/LP-2022-01"
            },
            {
              "name": "https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37"
            },
            {
              "name": "https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375",
              "refsource": "CONFIRM",
              "tags": [
                "Mitigation",
                "Third Party Advisory"
              ],
              "url": "https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375"
            },
            {
              "name": "FEDORA-2022-c138fbb8e0",
              "refsource": "FEDORA",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CFF6WJ5I7PSEBRF6I753WKE2BXFBGQXE/"
            },
            {
              "name": "FEDORA-2022-a42e97d8e8",
              "refsource": "FEDORA",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SLNABVK26CE4PFL57VLY242FW3QY4CPC/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 2.7
        }
      },
      "lastModifiedDate": "2022-03-25T14:20Z",
      "publishedDate": "2022-01-28T22:15Z"
    }
  }
}

GHSA-JQ4P-MQ33-W375

Vulnerability from github – Published: 2022-01-28 23:08 – Updated: 2022-02-07 21:16

Summary

Cross-site Scripting when rendering error messages in laminas-form

Details

Impact

When rendering validation error messages via the formElementErrors() view helper shipped with laminas-form, many messages will contain the submitted value. However, in vulnerable versions of laminas-form, the value was not being escaped for HTML contexts, which can potentially lead to a Reflected Cross-Site Scripting (XSS) attack.

Patches

The following versions were issued to mitigate the vulnerability:

2.17.1
3.0.2
3.1.1

Workarounds

At the top of a view script where you call the formElementErrors() view helper, place the following code:

use Laminas\Form\ElementInterface;
use Laminas\View\PhpRenderer;

$escapeMessages = function (ElementInterface $formOrElement, PhpRenderer $renderer): void {
    $messages = $element->getMessages();
    if (! $messages) {
        return;
    }

    $escaped  = [];
    array_walk_recursive(
        $messages,
        static function (string $item) use (&$escaped, $renderer): void {
            $escaped[] = $renderer->escapeHtml($item);
        }
    };

    $element->setMessages($escaped);
};

Before calling formElementErrors() with a form, fieldset, or element, call the above closure as follows

// Usage with a form
// $this is the view renderer
$escapeMessages($form, $this);

// Usage with a fieldset
// $this is the view renderer
$escapeMessages($fieldset, $this);

// Usage with a form element
// $this is the view renderer
$escapeMessages($element, $this);

For more information

If you have any questions or comments about this advisory:

Open an issue
Email us at security@getlaminas.org

Severity ?

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "laminas/laminas-form"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "laminas/laminas-form"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "laminas/laminas-form"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.17.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-23598"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-28T18:49:08Z",
    "nvd_published_at": "2022-01-28T22:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nWhen rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in vulnerable versions of laminas-form, the value was not being escaped for HTML contexts, which can potentially lead to a Reflected Cross-Site Scripting (XSS) attack.\n\n### Patches\n\nThe following versions were issued to mitigate the vulnerability:\n\n- 2.17.1\n- 3.0.2\n- 3.1.1\n\n### Workarounds\n\nAt the top of a view script where you call the `formElementErrors()` view helper, place the following code:\n\n```php\nuse Laminas\\Form\\ElementInterface;\nuse Laminas\\View\\PhpRenderer;\n\n$escapeMessages = function (ElementInterface $formOrElement, PhpRenderer $renderer): void {\n    $messages = $element-\u003egetMessages();\n    if (! $messages) {\n        return;\n    }\n\n    $escaped  = [];\n    array_walk_recursive(\n        $messages,\n        static function (string $item) use (\u0026$escaped, $renderer): void {\n            $escaped[] = $renderer-\u003eescapeHtml($item);\n        }\n    };\n\n    $element-\u003esetMessages($escaped);\n};\n```\n\nBefore calling `formElementErrors()` with a form, fieldset, or element, call the above closure as follows\n\n```php\n// Usage with a form\n// $this is the view renderer\n$escapeMessages($form, $this);\n\n// Usage with a fieldset\n// $this is the view renderer\n$escapeMessages($fieldset, $this);\n\n// Usage with a form element\n// $this is the view renderer\n$escapeMessages($element, $this);\n```\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* [Open an issue](https://github.com/laminas/laminas-form/issues/new)\n* Email us at [security@getlaminas.org](mailto:security@getlaminas.org)",
  "id": "GHSA-jq4p-mq33-w375",
  "modified": "2022-02-07T21:16:31Z",
  "published": "2022-01-28T23:08:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23598"
    },
    {
      "type": "WEB",
      "url": "https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37"
    },
    {
      "type": "WEB",
      "url": "https://getlaminas.org/security/advisory/LP-2022-01"
    },
    {
      "type": "WEB",
      "url": "https://github.com/laminas/laminas-form"
    },
    {
      "type": "WEB",
      "url": "https://github.com/laminas/laminas-form/releases/tag/2.17.1"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CFF6WJ5I7PSEBRF6I753WKE2BXFBGQXE"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SLNABVK26CE4PFL57VLY242FW3QY4CPC"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Cross-site Scripting when rendering error messages in laminas-form"
}

FKIE_CVE-2022-23598

Vulnerability from fkie_nvd - Published: 2022-01-28 22:15 - Updated: 2024-11-21 06:48

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://getlaminas.org/security/advisory/LP-2022-01	Mitigation, Third Party Advisory
security-advisories@github.com	https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37	Patch, Third Party Advisory
security-advisories@github.com	https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375	Mitigation, Third Party Advisory
security-advisories@github.com	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFF6WJ5I7PSEBRF6I753WKE2BXFBGQXE/
security-advisories@github.com	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLNABVK26CE4PFL57VLY242FW3QY4CPC/
af854a3a-2127-422b-91ae-364da2661108	https://getlaminas.org/security/advisory/LP-2022-01	Mitigation, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375	Mitigation, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFF6WJ5I7PSEBRF6I753WKE2BXFBGQXE/
af854a3a-2127-422b-91ae-364da2661108	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLNABVK26CE4PFL57VLY242FW3QY4CPC/

Impacted products

Vendor	Product	Version
getlaminas	laminas-form	*
getlaminas	laminas-form	*
getlaminas	laminas-form	3.1.0
fedoraproject	fedora	34
fedoraproject	fedora	35

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:getlaminas:laminas-form:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "87A945AD-C8D8-4BF9-AEFE-AB8F1018484D",
              "versionEndExcluding": "2.17.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:getlaminas:laminas-form:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "44B054C5-A156-47EC-AAD5-7AC4A6E9460E",
              "versionEndExcluding": "3.0.2",
              "versionStartIncluding": "3.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:getlaminas:laminas-form:3.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "98097242-DBA4-4D6A-8BD5-7263E1E06D3B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
              "matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
              "matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the `formElementErrors()` view helper. More information about this workaround is available on the GitHub Security Advisory."
    },
    {
      "lang": "es",
      "value": "laminas-form es un paquete para la comprobaci\u00f3n y visualizaci\u00f3n de formularios simples y complejos. Cuando son mostrados los mensajes de error de comprobaci\u00f3n por medio del ayudante de vista \"formElementErrors()\" incluido en laminas-form, muchos mensajes contienen el valor enviado. Sin embargo, en laminas-form versiones anteriores a 3.1.1, el valor no es escapado para los contextos HTML, lo que potencialmente pod\u00eda conllevar a un ataque de tipo Cross-site scripting reflejado. Las versiones 3.1.1 y superiores contienen un parche para mitigar la vulnerabilidad. Se presenta una soluci\u00f3n disponible. Puede colocarse manualmente un c\u00f3digo en la parte superior de un script de visualizaci\u00f3n donde es llamado al ayudante de visualizaci\u00f3n \"formElementErrors()\". Se presenta m\u00e1s informaci\u00f3n sobre esta medida de mitigaci\u00f3n en el aviso de seguridad de GitHub"
    }
  ],
  "id": "CVE-2022-23598",
  "lastModified": "2024-11-21T06:48:53.950",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-01-28T22:15:16.770",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://getlaminas.org/security/advisory/LP-2022-01"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFF6WJ5I7PSEBRF6I753WKE2BXFBGQXE/"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLNABVK26CE4PFL57VLY242FW3QY4CPC/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://getlaminas.org/security/advisory/LP-2022-01"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFF6WJ5I7PSEBRF6I753WKE2BXFBGQXE/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLNABVK26CE4PFL57VLY242FW3QY4CPC/"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2022-23598 (GCVE-0-2022-23598)

GSD-2022-23598

GHSA-JQ4P-MQ33-W375

Impact

Patches

Workarounds

For more information

FKIE_CVE-2022-23598

Tags

Sightings

Nomenclature