{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-05T06:32:45.199","vulnerabilities":[{"cve":{"id":"CVE-2022-23598","sourceIdentifier":"security-advisories@github.com","published":"2022-01-28T22:15:16.770","lastModified":"2024-11-21T06:48:53.950","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the `formElementErrors()` view helper. More information about this workaround is available on the GitHub Security Advisory."},{"lang":"es","value":"laminas-form es un paquete para la comprobación y visualización de formularios simples y complejos. Cuando son mostrados los mensajes de error de comprobación por medio del ayudante de vista \"formElementErrors()\" incluido en laminas-form, muchos mensajes contienen el valor enviado. Sin embargo, en laminas-form versiones anteriores a 3.1.1, el valor no es escapado para los contextos HTML, lo que potencialmente podía conllevar a un ataque de tipo Cross-site scripting reflejado. Las versiones 3.1.1 y superiores contienen un parche para mitigar la vulnerabilidad. Se presenta una solución disponible. Puede colocarse manualmente un código en la parte superior de un script de visualización donde es llamado al ayudante de visualización \"formElementErrors()\". Se presenta más información sobre esta medida de mitigación en el aviso de seguridad de GitHub"}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:getlaminas:laminas-form:*:*:*:*:*:*:*:*","versionEndExcluding":"2.17.1","matchCriteriaId":"87A945AD-C8D8-4BF9-AEFE-AB8F1018484D"},{"vulnerable":true,"criteria":"cpe:2.3:a:getlaminas:laminas-form:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"3.0.2","matchCriteriaId":"44B054C5-A156-47EC-AAD5-7AC4A6E9460E"},{"vulnerable":true,"criteria":"cpe:2.3:a:getlaminas:laminas-form:3.1.0:*:*:*:*:*:*:*","matchCriteriaId":"98097242-DBA4-4D6A-8BD5-7263E1E06D3B"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*","matchCriteriaId":"A930E247-0B43-43CB-98FF-6CE7B8189835"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*","matchCriteriaId":"80E516C0-98A4-4ADE-B69F-66A772E2BAAA"}]}]}],"references":[{"url":"https://getlaminas.org/security/advisory/LP-2022-01","source":"security-advisories@github.com","tags":["Mitigation","Third Party Advisory"]},{"url":"https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375","source":"security-advisories@github.com","tags":["Mitigation","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFF6WJ5I7PSEBRF6I753WKE2BXFBGQXE/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLNABVK26CE4PFL57VLY242FW3QY4CPC/","source":"security-advisories@github.com"},{"url":"https://getlaminas.org/security/advisory/LP-2022-01","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Third Party Advisory"]},{"url":"https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFF6WJ5I7PSEBRF6I753WKE2BXFBGQXE/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLNABVK26CE4PFL57VLY242FW3QY4CPC/","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}]}