GHSA-8q77-cv62-jj38: 
PHP vulnerability analysis and mitigation

Many Zend Framework 2 view helpers were using the escapeHtml() view helper to escape HTML attributes, instead of the more appropriate escapeHtmlAttr(). This vulnerability (GHSA-8q77-cv62-jj38) was discovered in Zend Framework versions >= 2.0.0, < 2.2.7 and >= 2.3.0, < 2.3.1, and was disclosed on April 15, 2014. The affected components included all Zend\Form view helpers, most Zend\Navigation view helpers, and all HTML Element view helpers (htmlFlash(), htmlPage(), htmlQuickTime(), and Zend\View\Helper\Gravatar) (Zend Advisory).

The vulnerability stemmed from the improper use of escapeHtml() instead of escapeHtmlAttr() for escaping HTML attribute values. In situations where user data and/or JavaScript was used to seed attributes, this could lead to potential cross-site scripting (XSS) attack vectors. The vulnerability has a CVSS v3.1 score of 6.1 (Moderate), with the following metrics: Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: Required, Scope: Changed, Confidentiality: Low, Integrity: Low, Availability: None (GitHub Advisory).

The vulnerability could allow attackers to execute cross-site scripting (XSS) attacks by injecting malicious JavaScript code through HTML attributes. This could potentially lead to unauthorized access to user data, session hijacking, or other client-side attacks (GitHub Advisory).

The vulnerability requires user interaction and can be exploited when user data or JavaScript is used to seed attributes in the affected view helpers. The attack vector is network-based with low complexity, requiring no special privileges (GitHub Advisory).

The vulnerability was patched in Zend Framework versions 2.2.7 and 2.3.1. The fix involved updating all affected view helpers to use the escapeHtmlAttr() view helper when escaping data for HTML attributes. Users should upgrade to these or later versions to protect against potential XSS attacks (Zend Advisory).

The Zend Framework team acknowledged the contributions of Evan Coury (github.com/EvanDotPro) for reporting the issue and Marco Pivetta (github.com/Ocramius) for providing a patch (Zend Advisory).