MediumGHSA-4v57-pwvf-x35j
Zendframework potential Cross-site Scripting vector in `Zend_Service_ReCaptcha_MailHide`
Published 7 Jun 2024 · Updated 7 Jun 2024
Affected packages
zendframework/zendframework1Composer
- Affected
- >=1.7.0 <1.7.9
- Fixed in
- 1.7.9
Update to the fixed version for your release line, for example:
composer require zendframework/zendframework1:^1.7.9zendframework/zendframework1Composer
- Affected
- >=1.8.0 <1.8.5
- Fixed in
- 1.8.5
Update to the fixed version for your release line, for example:
composer require zendframework/zendframework1:^1.8.5zendframework/zendframework1Composer
- Affected
- >=1.9.0 <1.9.7
- Fixed in
- 1.9.7
Update to the fixed version for your release line, for example:
composer require zendframework/zendframework1:^1.9.7Details
Zend_Service_ReCaptcha_MailHide had a potential XSS vulnerability. Due to the fact that the email address was never validated, and because its use of htmlentities() did not include the encoding argument, it was potentially possible for a malicious user aware of the issue to inject a specially crafted multibyte string as an attack via the CAPTCHA's email argument
Is GHSA-4v57-pwvf-x35j in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected zendframework/zendframework1, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.