PRIOn knowledge basePRION:CVE-2008-3197Cross site request forgery (csrf)
6.9 Medium
AI Score
Confidence
Low
3.5 Low
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N
0.002 Low
EPSS
Percentile
58.3%
Cross-site request forgery (CSRF) vulnerability in phpMyAdmin before 2.11.7.1 allows remote attackers to perform unauthorized actions via a link or IMG tag to (1) the db parameter in the “Creating a Database” functionality (db_create.php), and (2) the convcharset and collation_connection parameters related to an unspecified program that modifies the connection character set.
References
lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html
secunia.com/advisories/31097
secunia.com/advisories/31115
secunia.com/advisories/33822
sourceforge.net/project/shownotes.php?release_id=613660
www.debian.org/security/2008/dsa-1641
www.mandriva.com/security/advisories?name=MDVSA-2008:202
www.openwall.com/lists/oss-security/2008/07/15/6
www.vupen.com/english/advisories/2008/2116/references
yehg.net/lab/pr0js/advisories/XSRF_ConvertCharset_inPhpMyAdmin2.11.7.pdf
yehg.net/lab/pr0js/advisories/XSRF_CreateDB_inPhpMyAdmin2.11.7.pdf
exchange.xforce.ibmcloud.com/vulnerabilities/43846
www.phpmyadmin.net/home_page/downloads.php?relnotes=0
www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-5
www.redhat.com/archives/fedora-package-announce/2008-July/msg00590.html
www.redhat.com/archives/fedora-package-announce/2008-July/msg00652.html
Related
6.9 Medium
AI Score
Confidence
Low
3.5 Low
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N
0.002 Low
EPSS
Percentile
58.3%