Vulnerability Details : CVE-2012-4451
Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2012-4451
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:*:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:17:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:16:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2012-4451
1.78%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 81 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2012-4451
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
|
6.1
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
2.8
|
2.7
|
NIST |
CWE ids for CVE-2012-4451
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-4451
-
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688946#10
#688946 - zendframework: CVE-2012-4451 - Debian Bug report logsMailing List;Third Party Advisory
-
http://www.securityfocus.com/bid/55636
Zend Framework Multiple Cross Site Scripting VulnerabilitiesThird Party Advisory;VDB Entry
-
http://seclists.org/oss-sec/2012/q3/571
oss-sec: CVE Request -- php-ZendFramework: XSS vectors in multiple Zend Framework components (ZF2012-03)Mailing List;Patch;Third Party Advisory
-
http://framework.zend.com/security/advisory/ZF2012-03
Security Advisory - Security - Zend FrameworkVendor Advisory
-
https://github.com/zendframework/zf2/commit/27131ca9520bdf1d4c774c71459eba32f2b10733
Merge branch 'security/escaper-usage' · zendframework/zendframework@27131ca · GitHubPatch;Third Party Advisory
-
http://seclists.org/oss-sec/2012/q3/573
oss-sec: Re: CVE Request -- php-ZendFramework: XSS vectors in multiple Zend Framework components (ZF2012-03)Mailing List;Patch;Third Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=860738
860738 – (CVE-2012-4451) CVE-2012-4451 php-ZendFramework: XSS vectors in multiple Zend Framework components (ZF2012-03)Issue Tracking;Patch;Third Party Advisory
-
https://bugs.gentoo.org/show_bug.cgi?id=436210
436210 – (CVE-2012-4451) dev-php/ZendFramework: Multiple Cross-Site Scripting Vulnerabilities (CVE-2012-4451)Third Party Advisory
Jump to