CVE-2012-4451

Katalog CVE

CVSS 6.1 · Medium EPSS 1,4%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada zend framework, fedoraproject fedora +1 lainnya. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.

Rincian

Terbit di NVD

3 Januari 2020

Terakhir diubah

16 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 71,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://framework.zend.com/security/advisory/ZF2012-03 advisory vendor
• http://seclists.org/oss-sec/2012/q3/571 mailing list · patch · advisory pihak ketiga
• http://seclists.org/oss-sec/2012/q3/573 mailing list · patch · advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=860738 issue tracking · patch · advisory pihak ketiga
• https://github.com/zendframework/zf2/commit/27131ca9520bdf1d4c774c71459eba32f2b10733 patch · advisory pihak ketiga
• http://www.securityfocus.com/bid/55636 advisory pihak ketiga · vdb entry
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688946#10 mailing list · advisory pihak ketiga
• https://bugs.gentoo.org/show_bug.cgi?id=436210 advisory pihak ketiga