TI-2022-07651 Aliases CVE-2022-23598 GHSA-jq4p-mq33-w375

Reflected XSS vulnerability when rendering error messages in laminas-form

LOW 29CWE-79Published 2022-01-28 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the `formElementErrors()` view helper. More information about this workaround is available on the GitHub Security Advisory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00989 62nd percentileScored 2026-11-07

Fix Fixed laminas-form (laminas): 3.1.1laminas/laminas-form (Packagist): 3.1.1, 3.0.2, 2.17.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
laminas	laminas-form	before 3.1.1	3.1.1	Patch available	CNA
—	laminas/laminas-form (Packagist)	3.1.0 to before 3.1.1	3.1.1	Patch available	GHSA-jq4p-mq33-w375
—	laminas/laminas-form (Packagist)	3.0.0 to before 3.0.2	3.0.2	Patch available	GHSA-jq4p-mq33-w375
—	laminas/laminas-form (Packagist)	before 2.17.1	2.17.1	Patch available	GHSA-jq4p-mq33-w375

laminas-form Vendorlaminas Affected before 3.1.1 Fixed in 3.1.1 Patch available CNA
laminas/laminas-form (Packagist) Vendor— Affected 3.1.0 to before 3.1.1 Fixed in 3.1.1 Patch available GHSA-jq4p-mq33-w375
laminas/laminas-form (Packagist) Vendor— Affected 3.0.0 to before 3.0.2 Fixed in 3.0.2 Patch available GHSA-jq4p-mq33-w375
laminas/laminas-form (Packagist) Vendor— Affected before 2.17.1 Fixed in 2.17.1 Patch available GHSA-jq4p-mq33-w375

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:getlaminas:laminas-form::::::::	before 2.17.1; 3.0.0 to before 3.0.2	Vulnerable	laminas
cpe:2.3:a:getlaminas:laminas-form:3.1.0:::::::*	3.1.0	Vulnerable	laminas
cpe:2.3:o:fedoraproject:fedora:34:::::::*	34	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:35:::::::*	35	Vulnerable	Fedoraproject

cpe:2.3:a:getlaminas:laminas-form:*:*:*:*:*:*:*:* Versions before 2.17.1; 3.0.0 to before 3.0.2 Vulnerable ·laminas
cpe:2.3:a:getlaminas:laminas-form:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·laminas
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject

Remediation

Fix · CNA laminas-form (laminas) Fixed in 3.1.1
Fix · GHSA-jq4p-mq33-w375 laminas/laminas-form (Packagist) Fixed in 3.1.1 Advisory →
Fix · GHSA-jq4p-mq33-w375 laminas/laminas-form (Packagist) Fixed in 3.0.2 Advisory →
Fix · GHSA-jq4p-mq33-w375 laminas/laminas-form (Packagist) Fixed in 2.17.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2022-23598
2026-10-03 Alias added: GHSA-jq4p-mq33-w375

References

Patch 1

https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37

Advisory 5

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences