CVE-2020-26934

2020-10-1000:00:00

ubuntu.com

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.008 Low

EPSS

Percentile

81.9%

JSON

phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the
transformation feature via a crafted link.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=971999>

Notes

Author	Note
mdeslaur	vulerability was introduced in 2.5.0. File where issue is is different in bionic and earlier.
litios	intrusive patch for xenial and earlier as the signing funcionality is not present.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchphpmyadmin< 4:4.6.6-5ubuntu0.5UNKNOWN
ubuntu20.04noarchphpmyadmin< 4:4.9.5+dfsg1-2ubuntu0.1~esm1UNKNOWN
ubuntu14.04noarchphpmyadmin< anyUNKNOWN
ubuntu16.04noarchphpmyadmin< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	phpmyadmin	< 4:4.6.6-5ubuntu0.5	UNKNOWN
ubuntu	20.04	noarch	phpmyadmin	< 4:4.9.5+dfsg1-2ubuntu0.1~esm1	UNKNOWN
ubuntu	14.04	noarch	phpmyadmin	< any	UNKNOWN
ubuntu	16.04	noarch	phpmyadmin	< any	UNKNOWN