XSS in the import dialog

PMASA-2018-5

Announcement-ID: PMASA-2018-5

Date: 2018-08-21

Summary

XSS in the import dialog

Description

A Cross-Site Scripting vulnerability was found in the file import feature, where an attacker can deliver a payload to a user through importing a specially-crafted file.

Severity

We consider this attack to be of moderate severity.

Affected Versions

phpMyAdmin versions prior to 4.8.3

Solution

Upgrade to phpMyAdmin 4.8.3 or newer or apply patch listed below.

References

Assigned CVE ids: CVE-2018-15605

CWE ids: CWE-661

Patches

The following commits have been made on the 4.8 branch to fix this issue:

• 00d90b3ae415b31338f76263359467a9fbebd0a1

More information

For further information and in case of questions, please contact the phpMyAdmin team. Our website is phpmyadmin.net.