CVE-2012-4451 Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubS...
MediumCVSS 6.1
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Zend Technologies Zend Framework | = 2.0.x before 2.0.1 | No fix listed |
| zend framework | < 2.0.1 | 2.0.1 |
| fedoraproject fedora | = 16 | No fix listed |
| fedoraproject fedora | = 17 | No fix listed |
| redhat enterprise linux | = 6.0 | No fix listed |
References
- bugs.debian.org mailing-list third-party-advisory
- bugs.gentoo.org third-party-advisory
- seclists.org mailing-list patch third-party-advisory
- seclists.org mailing-list patch third-party-advisory
- framework.zend.com vendor-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- github.com patch third-party-advisory
- www.securityfocus.com third-party-advisory vdb-entry