Detections
Analytics

SCA: security update for laminas/laminas-diactoros (GHSA-8274-h5jp-97vr)

medium Tenable Cloud Security Plugin ID 412356

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - laminas-diactoros is a PHP package containing implementations of the PSR-7 HTTP message interfaces and
 PSR-17 HTTP message factory interfaces. Applications that use Diactoros, and are either not behind a
 proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol, and/or port of a
 `Laminas\Diactoros\Uri` instance associated with the incoming server request modified to reflect values
 from `X-Forwarded-*` headers. Such changes can potentially lead to XSS attacks (if a fully-qualified URL
 is used in links) and/or URL poisoning. Since the `X-Forwarded-*` headers do have valid use cases,
 particularly in clustered environments using a load balancer, the library offers mitigation measures only
 in the v2 releases, as doing otherwise would break these use cases immediately. Users of v2 releases from
 2.11.1 can provide an additional argument to `Laminas\Diactoros\ServerRequestFactory::fromGlobals()` in
 the form of a `Laminas\Diactoros\RequestFilter\RequestFilterInterface` instance, including the shipped
 `Laminas\Diactoros\RequestFilter\NoOpRequestFilter` implementation which ignores the `X-Forwarded-*`
 headers. Starting in version 3.0, the library will reverse behavior to use the `NoOpRequestFilter` by
 default, and require users to opt-in to `X-Forwarded-*` header usage via a configured
 `Laminas\Diactoros\RequestFilter\LegacyXForwardedHeaderFilter` instance. Users are advised to upgrade to
 version 2.11.1 or later to resolve this issue. Users unable to upgrade may configure web servers to reject
 `X-Forwarded-*` headers at the web server level. (CVE-2022-31109)

See Also

https://github.com/advisories/GHSA-8274-h5jp-97vr

Plugin Details

Severity: Medium

ID: 412356

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 8.67

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2022-31109

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/27/2022

Vulnerability Publication Date: 7/27/2022

Reference Information

CVE: CVE-2022-31109

cwe: CWE-79