Cross-site scripting in Zend Framework
Priority LOW 30CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.
Why it matters now
EPSS 0.01367 72nd percentileScored 2026-11-07
Fix Fixed Zend Framework (Zend Technologies): 2.0.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Zend Technologies | Zend Framework | 2.0 to before 2.0.1 | 2.0.1 | Patch available | CNA |
- Zend Framework VendorZend Technologies Affected 2.0 to before 2.0.1 Fixed in 2.0.1 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zend:zend_framework:*:*:*:*:*:*:*:* | before 2.0.1 | Vulnerable | Zend |
| cpe:2.3:o:fedoraproject:fedora:16:*:*:*:*:*:*:* | 16 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:17:*:*:*:*:*:*:* | 17 | Vulnerable | Fedoraproject |
| cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
- cpe:2.3:a:zend:zend_framework:*:*:*:*:*:*:*:* Versions before 2.0.1 Vulnerable ·Zend
- cpe:2.3:o:fedoraproject:fedora:16:*:*:*:*:*:*:* Versions 16 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:17:*:*:*:*:*:*:* Versions 17 Vulnerable ·Fedoraproject
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
Remediation
- Fix · CNA Zend Framework (Zend Technologies) Fixed in 2.0.1
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2012-4451
- 2026-10-03 Alias added: GHSA-3rph-pvh6-rj33
References
Patch 4
Sources
- CVE-2012-4451 · CVE Program
- CVE-2012-4451 · NVD
- FIRST EPSS
- GHSA-3rph-pvh6-rj33 · GitHub Advisory Database · CC BY 4.0
- CVE-2012-4451 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences