CVE-2012-4451

MEDIUM 6.1CVE-2012-4451 · Published 03/01/2020 · updated 16/06/2026

Package	Affected versions	Patched versions
zend framework zend	`< 2.0.1`	`2.0.1`

Description

Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.

References

framework.zend.com/security/advisory/ZF2012-03 · Vendor Advisory
seclists.org/oss-sec/2012/q3/571 · Mailing List
seclists.org/oss-sec/2012/q3/573 · Mailing List
securityfocus.com/bid/55636 · Third Party Advisory
bugs.debian.org/cgi-bin/bugreport.cgi · Mailing List
bugs.gentoo.org/show_bug.cgi · Third Party Advisory
bugzilla.redhat.com/show_bug.cgi · Issue Tracking
zendframework/zf2 commit 27131ca · Patch

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free