-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper escaping in HTML attribute contexts. The commit diff shows the AbstractHelper's createAttributesString method was modified to use escapeHtmlAttr() instead of escapeHtml() for attribute values. Since this is a base class for form view helpers, this vulnerability affected all Zend\Form view helpers. The CWE-79 context confirms this is an XSS issue caused by improper escaping during HTML attribute generation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| zendframework/zend-form | composer | >= 2.0.0, < 2.2.7 | 2.2.7 |
| zendframework/zend-form | composer | >= 2.3.0, < 2.3.1 | 2.3.1 |