Sign in
Deutsch English Español Polski
Medium

ZendFramework Potential Cross-site Scripting in Development Environment Error View Script

  • Disclosed: 07.06.2024
  • Updated: 11.10.2026 10:22

The default error handling view script generated using Zend_Tool failed to escape request parameters when run in the "development" configuration environment, providing a potential XSS attack vector.

Zend_Tool_Project_Context_Zf_ViewScriptFile was patched such that the view script template now calls the escape() method on dumped request variables.

Zend Framework 1.11.4 includes a patch that adds escaping to the generated error/error.phtml view script, ensuring that request variables are escaped appropriately for the browser. Do note, however, that this will not update any previously generated code. You will still need to follow the next advice for previously generated error view scripts.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package zendframework/zendframework1 >= 1.0.0, < 1.11.4 1.11.4

References

CVSS score 6.1/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE)
CWE-79
Platform
Composer
Package
zendframework/zendframework1
Disclosed
07.06.2024
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-g52p-86j5-xr8q - CC BY 4.0

Vulnerability history: zendframework/zendframework1

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (34) in the archive
Total entries
34
First → latest
05.2022 06.2024
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 8
  • High 9
  • Medium 17

Disclosures per year

Severity:
  1. Zendframework1 Potential SQL injection in ORDER and GROUP functions
    Critical · 9.8 ghsa-6fqw-j3vm-7f66 < 1.12.20 1.12.20
  2. Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability
    High · 7.5 ghsa-848f-mph5-9pm9 >= 1.12.0, < 1.12.17 1.12.17
  3. ZendFramework1 Potential Insufficient Entropy Vulnerability
    High · 7.5 ghsa-8xhv-gqm4-3w99 >= 1.12.0, < 1.12.18 1.12.18
  4. Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite)
    Critical · 9.8 ghsa-v42g-7q2x-cw32 >= 1.12.0, < 1.12.16 1.12.16
  5. ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select
    Critical · 9.8 ghsa-2x36-qhx3-7m5f >= 1.12.0, < 1.12.7 1.12.7
  6. Zendframework potential security issue in login mechanism
    High · 7.5 ghsa-9v78-h226-2rmq >= 1.12.0, < 1.12.4 1.12.4
  7. Zendframework Local file disclosure via XXE injection in Zend_XmlRpc
    High · 8.6 ghsa-229x-22xc-2f2w >= 1.0.0, < 1.11.13 1.11.13
  8. Zendframework Denial of Service vector via XEE injection
    High · 7.5 ghsa-2jx7-xg83-j2m7 >= 1.0.0, < 1.11.13 1.11.13
  9. ZendFramework Potential Cross-site Scripting in Development Environment Error View Script this entry
    Medium · 6.1 ghsa-g52p-86j5-xr8q >= 1.0.0, < 1.11.4 1.11.4
  10. ZendFramework potential XML eXternal Entity injection vectors
    Critical · 9.8 ghsa-mhpx-3rv8-wrjm >= 1.12.0, < 1.12.4 1.12.4
  11. ZendFramework potential XML eXternal Entity injection vectors
    High · 7.5 ghsa-4j9x-g4x8-vcmf >= 1.11.0, < 1.11.15, >= 1.12.0, < 1.12.1 1.11.15, 1.12.1
  12. ZendFramework potential SQL Injection Vector When Using PDO_MySql
    Critical · 9.8 ghsa-qf36-fx9f-232x >= 1.10.0, < 1.10.9, >= 1.11.0, < 1.11.6 1.10.9, 1.11.6
  13. ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()`
    High · 7.5 ghsa-hx3m-959f-v849 >= 1.7.0, < 1.7.5 1.7.5
  14. Zend Framework SQL injection vulnerability
    Critical · 9.8 CVE-2014-8089 >= 1.12.0, < 1.12.9 1.12.9
  15. Zend Framework XXE Vulnerability
    High · 7.3 CVE-2012-3363 >= 1.0.0, < 1.11.12, >= 1.12.0-rc1, < 1.12.0 1.11.12, 1.12.0
  16. Doctrine Security Misconfiguration Vulnerability
    High · 7.8 CVE-2015-5723 >= 1.12.0, < 1.12.16 1.12.16
  17. Zend Framework SQL injection vector using null byte for PDO
    Critical · 9.8 CVE-2015-7695 < 1.12.16 1.12.16
  18. Zend Framework Allows SQL Injection
    Critical · 9.8 CVE-2016-6233 < 1.12.19 1.12.19

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.