{"id":"GHSA-33rh-5hvf-5jjp","aliases":["CVE-2015-1039"],"title":"ZF-Commons ZfcUser Vulnerable to XSS in Login Redirect","description":"Cross-site scripting (XSS) vulnerability in `user/login.phtml` in ZF-Commons ZfcUser before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter.","severity":"medium","score":5.3,"published":"2022-05-17T04:17:28.000Z","modified":"2024-04-25T22:43:36.722Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"zf-commons/zfc-user","ranges":[{"events":[{"introduced":"0"},{"fixed":"1.2.2"}],"type":"ECOSYSTEM"}],"versions":["0.0.1","0.1.0","0.1.1","0.1.2","0.1.3","0.2.0","1.0.0","1.1.0","1.2.0","1.2.1"],"fixed":["1.2.2"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2015-1039","https://github.com/ZF-Commons/ZfcUser/issues/550","https://github.com/ZF-Commons/ZfcUser/commit/baf0e460","https://github.com/FriendsOfPHP/security-advisories/blob/master/zf-commons/zfc-user/CVE-2015-1039.yaml","https://github.com/ZF-Commons/ZfcUser","https://web.archive.org/web/20150202091028/http://www.securityfocus.com/bid/71931","http://www.openwall.com/lists/oss-security/2015/01/11/4"],"sources":[{"name":"OSV","id":"GHSA-33rh-5hvf-5jjp","modified":"2024-04-25T22:43:36.722416Z","url":"https://osv.dev/vulnerability/GHSA-33rh-5hvf-5jjp"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3}]}