medium6.1
CVE-2015-3257
zend-diactoros Cross-site Scripting (XSS)
Impact
`Zend/Diactoros/Uri::filterPath` in zend-diactoros before 1.0.4 does not properly sanitize path input, which allows remote attackers to perform cross-site scripting (XSS) or open redirect attacks.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | zendframework/zend-diactoros | >= 1.0.0, < 1.0.4 | 1.0.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zend | Diactoros | through 1.0.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.securityfocus.com/bid/75466
- https://framework.zend.com/security/advisory/ZF2015-05
- https://github.com/advisories/GHSA-rh3c-7wqx-6w95
- https://nvd.nist.gov/vuln/detail/CVE-2015-3257
- https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-diactoros/CVE-2015-3257.yaml