Описание
Zendframework Potential XSS or HTML Injection vector in Zend_Json
Zend_Json_Encoder was not taking into account the solidus character (/) during encoding, leading to incompatibilities with the JSON specification, and opening the potential for XSS or HTML injection attacks when returning HTML within a JSON string.
Пакеты
Наименование
zendframework/zendframework1
composer
Затронутые версииВерсия исправления
>= 1.7.0, < 1.7.9
1.7.9
Наименование
zendframework/zendframework1
composer
Затронутые версииВерсия исправления
>= 1.8.0, < 1.8.5
1.8.5
Наименование
zendframework/zendframework1
composer
Затронутые версииВерсия исправления
>= 1.9.0, < 1.9.7
1.9.7
6.1 Medium
CVSS3
Дефекты
CWE-79
6.1 Medium
CVSS3
Дефекты
CWE-79