GHSA-vvm3-rv48-j3g5: Zendframework Potential XSS or HTML Injection vector in Zend_Json

June 7, 2024

Zend_Json_Encoder was not taking into account the solidus character (/) during encoding, leading to incompatibilities with the JSON specification, and opening the potential for XSS or HTML injection attacks when returning HTML within a JSON string.

References

github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2010-06.yaml
github.com/advisories/GHSA-vvm3-rv48-j3g5
github.com/zendframework/zf1
web.archive.org/web/20200228150030/https://framework.zend.com/security/advisory/ZF2010-06

Code Behaviors & Features

Detect and mitigate GHSA-vvm3-rv48-j3g5 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →