Multiple Cross-Site Scripting Vulnerabilities in Zend Framework

Release date:
Updated on:

Affected Systems:
Zend Framework 2.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 55636

Zend Framework (ZF) is an open-source PHP5 development Framework that can be used to develop Web programs and services.

In versions earlier than Zend Framework 2.0.1, multiple cross-site scripting vulnerabilities exist, incorrect verification is sent to Zend \ Feed \ PubSubHubbub, Zend \ Log \ Formatter \ Xml, Zend \ Tag \ Cloud \ Decorator, Zend \ Uri, Zend \ View \ Helper \ HeadStyle, Zend \ view \ Helper \ Navigation \ Sitemap, Zend \ View \ Helper \ Placeholder \ Container \ AbstractStandalone input, attackers can exploit these vulnerabilities to execute arbitrary script code in the user's browser of the affected site to steal Cookie authentication creden.

<* Source: Robert Basic

Link: http://secunia.com/advisories/50682/
Http://framework.zend.com/security/advisory/ZF2012-03
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Zend
----
Zend has released a Security Bulletin (ZF2012-03) and corresponding patches for this:

ZF2012-03: ZF2012-03: Potential XSS Vectors in Multiple Zend Framework 2 Components

Link: http://framework.zend.com/security/advisory/ZF2012-03