CVE-2022-23598
Description
laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the `formElementErrors()` view helper. More information about this workaround is available on the GitHub Security Advisory.
How to fix
- getlaminas laminas-form2.17.1, 3.0.2 or later
- laminas/laminas-form3.1.1, 3.0.2, 2.17.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| getlaminas laminas-form | v < 2.17.1, 3.0.0 ≤ v < 3.0.2, 3.1.0 | 2.17.1, 3.0.2 |
| fedoraproject fedora | 34, 35 | — |
| laminas/laminas-formPackagist | 3.1.0 ≤ v < 3.1.1, 3.0.0 ≤ v < 3.0.2, v < 2.17.1 | 3.1.1, 3.0.2, 2.17.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.