{"containers": {"cna": {"affected": [{"product": "laminas-form", "vendor": "laminas", "versions": [{"status": "affected", "version": "< 3.1.1"}]}], "descriptions": [{"lang": "en", "value": "laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the `formElementErrors()` view helper. More information about this workaround is available on the GitHub Security Advisory."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-02-10T03:06:23", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37"}, {"tags": ["x_refsource_MISC"], "url": "https://getlaminas.org/security/advisory/LP-2022-01"}, {"name": "FEDORA-2022-a42e97d8e8", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLNABVK26CE4PFL57VLY242FW3QY4CPC/"}, {"name": "FEDORA-2022-c138fbb8e0", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFF6WJ5I7PSEBRF6I753WKE2BXFBGQXE/"}], "source": {"advisory": "GHSA-jq4p-mq33-w375", "discovery": "UNKNOWN"}, "title": "Reflected XSS vulnerability when rendering error messages in laminas-form", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-23598", "STATE": "PUBLIC", "TITLE": "Reflected XSS vulnerability when rendering error messages in laminas-form"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "laminas-form", "version": {"version_data": [{"version_value": "< 3.1.1"}]}}]}, "vendor_name": "laminas"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the `formElementErrors()` view helper. More information about this workaround is available on the GitHub Security Advisory."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}]}, "references": {"reference_data": [{"name": "https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375", "refsource": "CONFIRM", "url": "https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375"}, {"name": "https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37", "refsource": "MISC", "url": "https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37"}, {"name": "https://getlaminas.org/security/advisory/LP-2022-01", "refsource": "MISC", "url": "https://getlaminas.org/security/advisory/LP-2022-01"}, {"name": "FEDORA-2022-a42e97d8e8", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SLNABVK26CE4PFL57VLY242FW3QY4CPC/"}, {"name": "FEDORA-2022-c138fbb8e0", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CFF6WJ5I7PSEBRF6I753WKE2BXFBGQXE/"}]}, "source": {"advisory": "GHSA-jq4p-mq33-w375", "discovery": "UNKNOWN"}}}}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-23598", "datePublished": "2022-01-28T22:00:16", "dateReserved": "2022-01-19T00:00:00", "dateUpdated": "2022-02-10T03:06:23", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:getlaminas:laminas-form:*:*:*:*:*:*:*:*", "matchCriteriaId": "87A945AD-C8D8-4BF9-AEFE-AB8F1018484D", "versionEndExcluding": "2.17.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:getlaminas:laminas-form:*:*:*:*:*:*:*:*", "matchCriteriaId": "44B054C5-A156-47EC-AAD5-7AC4A6E9460E", "versionEndExcluding": "3.0.2", "versionStartIncluding": "3.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:getlaminas:laminas-form:3.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "98097242-DBA4-4D6A-8BD5-7263E1E06D3B", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*", "matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*", "matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the `formElementErrors()` view helper. More information about this workaround is available on the GitHub Security Advisory."}, {"lang": "es", "value": "laminas-form es un paquete para la comprobaci\u00f3n y visualizaci\u00f3n de formularios simples y complejos. Cuando son mostrados los mensajes de error de comprobaci\u00f3n por medio del ayudante de vista \"formElementErrors()\" incluido en laminas-form, muchos mensajes contienen el valor enviado. Sin embargo, en laminas-form versiones anteriores a 3.1.1, el valor no es escapado para los contextos HTML, lo que potencialmente pod\u00eda conllevar a un ataque de tipo Cross-site scripting reflejado. Las versiones 3.1.1 y superiores contienen un parche para mitigar la vulnerabilidad. Se presenta una soluci\u00f3n disponible. Puede colocarse manualmente un c\u00f3digo en la parte superior de un script de visualizaci\u00f3n donde es llamado al ayudante de visualizaci\u00f3n \"formElementErrors()\". Se presenta m\u00e1s informaci\u00f3n sobre esta medida de mitigaci\u00f3n en el aviso de seguridad de GitHub"}], "id": "CVE-2022-23598", "lastModified": "2023-11-07T03:44:15.020", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2022-01-28T22:15:16.770", "references": [{"source": "security-advisories@github.com", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://getlaminas.org/security/advisory/LP-2022-01"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375"}, {"source": "security-advisories@github.com", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFF6WJ5I7PSEBRF6I753WKE2BXFBGQXE/"}, {"source": "security-advisories@github.com", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLNABVK26CE4PFL57VLY242FW3QY4CPC/"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{}