CVE-2018-19970

2018-12-1100:00:00

ubuntu.com

phpmyadmin

xss

vulnerability

navigation tree

attacker

payload

crafted database

unix

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.071

Percentile

94.0%

JSON

In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the
navigation tree, where an attacker can deliver a payload to a user through
a crafted database/table name.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchphpmyadmin< 4:4.6.6-5ubuntu0.5UNKNOWN
ubuntu14.04noarchphpmyadmin< 4:4.0.10-1ubuntu0.1+esm1UNKNOWN
ubuntu16.04noarchphpmyadmin< 4:4.5.4.1-2ubuntu2.1+esm3UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	phpmyadmin	< 4:4.6.6-5ubuntu0.5	UNKNOWN
ubuntu	14.04	noarch	phpmyadmin	< 4:4.0.10-1ubuntu0.1+esm1	UNKNOWN
ubuntu	16.04	noarch	phpmyadmin	< 4:4.5.4.1-2ubuntu2.1+esm3	UNKNOWN