GHSA-2g98-f9jv-w8c5: 
PHP vulnerability analysis and mitigation

A high-severity XPath injection vulnerability was identified in the robrichards/xmlseclibs library (GHSA-2g98-f9jv-w8c5). The vulnerability affects versions 1.0.0 through 3.0.2 of the library and was discovered due to inadequate filtering of user input before its incorporation into XPath expressions. The issue was addressed and fixed in version 3.0.2 (GitHub Advisory).

The vulnerability is classified with a CVSS v3.1 score of 7.5 (High), with the following base metrics: Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, High confidentiality impact, and No impact on integrity or availability. The vulnerability is categorized as CWE-91. The technical issue stems from unfiltered user input being directly incorporated into XPath queries, potentially allowing malicious input to manipulate the query structure (GitHub Advisory).

The vulnerability primarily affects the confidentiality of data, with a High impact rating according to CVSS metrics. The successful exploitation of this XPath injection vulnerability could potentially allow attackers to manipulate XPath queries and access unauthorized data (GitHub Advisory).

The vulnerability has a Network attack vector with Low attack complexity, requiring no privileges or user interaction for exploitation. This combination of factors makes the vulnerability relatively easy to exploit if left unpatched (GitHub Advisory).

The vulnerability has been patched in version 3.0.2 of the library. The fix implements proper input filtering for XPath expressions using a whitelist approach that only allows letters, numericals, spaces, dashes, and underscores. Users are advised to upgrade to version 3.0.2 or later to address this security issue (GitHub Commit).