Lucene search

GitHub Advisory DatabaseGHSA-5P69-RMX8-7GW7

HistoryMay 17, 2022 - 4:19 a.m.

phpMyAdmin Multiple XSS Vulnerabilities

2022-05-1704:19:07

CWE-79

GitHub Advisory Database

github.com

phpmyadmin

xss

vulnerabilities

pma_uninlineeditrow

remote users

web script

html

database name

table name

column name

inline editing

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

49.5%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in the PMA_unInlineEditRow function in js/sql.js in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a (1) database name, (2) table name, or (3) column name that is not properly handled after an inline-editing operation.

Affected configurations

Vulners

Node

phpmyadminphpmyadminRange3.4.0–3.4.5

VendorProductVersionCPE
phpmyadminphpmyadmin*cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
phpmyadmin	phpmyadmin	*	cpe:2.3:a:phpmyadmin:phpmyadmin::::::::

References

www.openwall.com/lists/oss-security/2011/09/30/8

www.phpmyadmin.net/home_page/security/PMASA-2011-14.php

bugzilla.redhat.com/show_bug.cgi?id=738681

github.com/advisories/GHSA-5p69-rmx8-7gw7

github.com/phpmyadmin/phpmyadmin/commit/2f28ce9c800274190418da0945ce3647d36e1db6

github.com/phpmyadmin/phpmyadmin/commit/bda213c58aec44925be661acb0e76c19483ea170

nvd.nist.gov/vuln/detail/CVE-2011-3592

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

49.5%

JSON

Related for GHSA-5P69-RMX8-7GW7