Lucene search

K
freebsdFreeBSDFBB01289-2645-11E4-BC44-6805CA0B3D42
HistoryAug 17, 2014 - 12:00 a.m.

phpMyAdmin -- XSS vulnerabilities

2014-08-1700:00:00
vuxml.freebsd.org
15

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

50.7%

The phpMyAdmin development team reports:

Multiple XSS vulnerabilities in browse table, ENUM
editor, monitor, query charts and table relations pages.
With a crafted database, table or a primary/unique key
column name it is possible to trigger an XSS when dropping
a row from the table. With a crafted column name it is
possible to trigger an XSS in the ENUM editor dialog. With
a crafted variable name or a crafted value for unit field
it is possible to trigger a self-XSS when adding a new
chart in the monitor page. With a crafted value for x-axis
label it is possible to trigger a self-XSS in the query
chart page. With a crafted relation name it is possible to
trigger an XSS in table relations page.

XSS in view operations page.
With a crafted view name it is possible to trigger an
XSS when dropping the view in view operation page.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchphpmyadmin= 4.2.0UNKNOWN
FreeBSDanynoarchphpmyadmin< 4.2.7.1UNKNOWN

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

50.7%