Lucene search

[email protected]NVD:CVE-2008-3197

HistoryJul 16, 2008 - 6:41 p.m.

CVE-2008-3197

2008-07-1618:41:00

CWE-352

[email protected]

web.nvd.nist.gov

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

AI Score

5.6

Confidence

High

EPSS

0.002

Percentile

62.6%

JSON

Cross-site request forgery (CSRF) vulnerability in phpMyAdmin before 2.11.7.1 allows remote attackers to perform unauthorized actions via a link or IMG tag to (1) the db parameter in the “Creating a Database” functionality (db_create.php), and (2) the convcharset and collation_connection parameters related to an unspecified program that modifies the connection character set.

Affected configurations

Nvd

Node

phpmyadminphpmyadminMatch2.0

phpmyadminphpmyadminMatch2.0.0

phpmyadminphpmyadminMatch2.0.1

phpmyadminphpmyadminMatch2.0.2

phpmyadminphpmyadminMatch2.0.3

phpmyadminphpmyadminMatch2.0.4

phpmyadminphpmyadminMatch2.0.5

phpmyadminphpmyadminMatch2.1

phpmyadminphpmyadminMatch2.1.0

phpmyadminphpmyadminMatch2.1.1

phpmyadminphpmyadminMatch2.1.2

phpmyadminphpmyadminMatch2.2

phpmyadminphpmyadminMatch2.2.0

phpmyadminphpmyadminMatch2.2.0_pre1

phpmyadminphpmyadminMatch2.2.0_pre2

phpmyadminphpmyadminMatch2.2.0_rc1

phpmyadminphpmyadminMatch2.2.0_rc2

phpmyadminphpmyadminMatch2.2.0_rc3

phpmyadminphpmyadminMatch2.2.2

phpmyadminphpmyadminMatch2.2.3

phpmyadminphpmyadminMatch2.2.4

phpmyadminphpmyadminMatch2.2.5

phpmyadminphpmyadminMatch2.2.6

phpmyadminphpmyadminMatch2.2.7_pl1

phpmyadminphpmyadminMatch2.2_pre1

phpmyadminphpmyadminMatch2.2_pre2

phpmyadminphpmyadminMatch2.2_rc1

phpmyadminphpmyadminMatch2.2_rc2

phpmyadminphpmyadminMatch2.2_rc3

phpmyadminphpmyadminMatch2.3.1

phpmyadminphpmyadminMatch2.3.2

phpmyadminphpmyadminMatch2.4.0

phpmyadminphpmyadminMatch2.5.0

phpmyadminphpmyadminMatch2.5.1

phpmyadminphpmyadminMatch2.5.2

phpmyadminphpmyadminMatch2.5.2_pl1

phpmyadminphpmyadminMatch2.5.3

phpmyadminphpmyadminMatch2.5.4

phpmyadminphpmyadminMatch2.5.5

phpmyadminphpmyadminMatch2.5.5_pl1

phpmyadminphpmyadminMatch2.5.5_rc1

phpmyadminphpmyadminMatch2.5.5_rc2

phpmyadminphpmyadminMatch2.5.6_rc1

phpmyadminphpmyadminMatch2.5.6_rc2

phpmyadminphpmyadminMatch2.5.7

phpmyadminphpmyadminMatch2.5.7_pl1

phpmyadminphpmyadminMatch2.6.0_pl1

phpmyadminphpmyadminMatch2.6.0_pl2

phpmyadminphpmyadminMatch2.6.0_pl3

phpmyadminphpmyadminMatch2.6.1

phpmyadminphpmyadminMatch2.6.1_pl1

phpmyadminphpmyadminMatch2.6.1_pl3

phpmyadminphpmyadminMatch2.6.1_rc1

phpmyadminphpmyadminMatch2.6.2

phpmyadminphpmyadminMatch2.6.2_dev

phpmyadminphpmyadminMatch2.6.2_pl1

phpmyadminphpmyadminMatch2.6.2_rc1

phpmyadminphpmyadminMatch2.6.3

phpmyadminphpmyadminMatch2.6.3_pl1

phpmyadminphpmyadminMatch2.6.4

phpmyadminphpmyadminMatch2.6.4_pl1

phpmyadminphpmyadminMatch2.6.4_pl2

phpmyadminphpmyadminMatch2.6.4_pl3

phpmyadminphpmyadminMatch2.6.4_pl4

phpmyadminphpmyadminMatch2.6.4_rc1

phpmyadminphpmyadminMatch2.7

phpmyadminphpmyadminMatch2.7.0

phpmyadminphpmyadminMatch2.7.0_beta1

phpmyadminphpmyadminMatch2.7.0_pl1

phpmyadminphpmyadminMatch2.7.0_pl2

phpmyadminphpmyadminMatch2.7.0_rc1

phpmyadminphpmyadminMatch2.7_pl1

phpmyadminphpmyadminMatch2.8.0

phpmyadminphpmyadminMatch2.8.0.1

phpmyadminphpmyadminMatch2.8.0.2

phpmyadminphpmyadminMatch2.8.0.3

phpmyadminphpmyadminMatch2.8.1

phpmyadminphpmyadminMatch2.8.1_dev

phpmyadminphpmyadminMatch2.8.2

phpmyadminphpmyadminMatch2.8.3

phpmyadminphpmyadminMatch2.8.4

phpmyadminphpmyadminMatch2.9

phpmyadminphpmyadminMatch2.9.0

phpmyadminphpmyadminMatch2.9.0.1

phpmyadminphpmyadminMatch2.9.0.2

phpmyadminphpmyadminMatch2.9.0.3

phpmyadminphpmyadminMatch2.9.0_beta1

phpmyadminphpmyadminMatch2.9.0_dev

phpmyadminphpmyadminMatch2.9.0_rc1

phpmyadminphpmyadminMatch2.9.1

phpmyadminphpmyadminMatch2.9.1.1

phpmyadminphpmyadminMatch2.9.1_rc1

phpmyadminphpmyadminMatch2.9.1_rc2

phpmyadminphpmyadminMatch2.9.2

phpmyadminphpmyadminMatch2.9_rc1

phpmyadminphpmyadminMatch2.10.0

phpmyadminphpmyadminMatch2.10.0.0

phpmyadminphpmyadminMatch2.10.0.1

phpmyadminphpmyadminMatch2.10.0.2

phpmyadminphpmyadminMatch2.10.1

phpmyadminphpmyadminMatch2.10.01

phpmyadminphpmyadminMatch2.10.1.0

phpmyadminphpmyadminMatch2.10.2

phpmyadminphpmyadminMatch2.10.2.0

phpmyadminphpmyadminMatch2.10.3

phpmyadminphpmyadminMatch2.10.3.0

phpmyadminphpmyadminMatch2.10.3rc1

phpmyadminphpmyadminMatch2.11.0

phpmyadminphpmyadminMatch2.11.0.0

phpmyadminphpmyadminMatch2.11.0beta1

phpmyadminphpmyadminMatch2.11.0rc1

phpmyadminphpmyadminMatch2.11.1

phpmyadminphpmyadminMatch2.11.1.0

phpmyadminphpmyadminMatch2.11.1.1

phpmyadminphpmyadminMatch2.11.1.2

phpmyadminphpmyadminMatch2.11.1rc1

phpmyadminphpmyadminMatch2.11.2

phpmyadminphpmyadminMatch2.11.2.0

phpmyadminphpmyadminMatch2.11.2.1

phpmyadminphpmyadminMatch2.11.2.2

phpmyadminphpmyadminMatch2.11.3

phpmyadminphpmyadminMatch2.11.3.0

phpmyadminphpmyadminMatch2.11.3rc1

phpmyadminphpmyadminMatch2.11.4

phpmyadminphpmyadminMatch2.11.4.0

phpmyadminphpmyadminMatch2.11.4rc1

phpmyadminphpmyadminMatch2.11.5

phpmyadminphpmyadminMatch2.11.5.0

phpmyadminphpmyadminMatch2.11.5.1

phpmyadminphpmyadminMatch2.11.5.2

phpmyadminphpmyadminMatch2.11.5rc1

phpmyadminphpmyadminMatch2.11.6

phpmyadminphpmyadminMatch2.11.6rc1

phpmyadminphpmyadminMatch2.11.7.0

References

lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html

secunia.com/advisories/31097

secunia.com/advisories/31115

secunia.com/advisories/33822

sourceforge.net/project/shownotes.php?release_id=613660

www.debian.org/security/2008/dsa-1641

www.mandriva.com/security/advisories?name=MDVSA-2008:202

www.openwall.com/lists/oss-security/2008/07/15/6

www.phpmyadmin.net/home_page/downloads.php?relnotes=0

www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-5

www.vupen.com/english/advisories/2008/2116/references

yehg.net/lab/pr0js/advisories/XSRF_ConvertCharset_inPhpMyAdmin2.11.7.pdf

yehg.net/lab/pr0js/advisories/XSRF_CreateDB_inPhpMyAdmin2.11.7.pdf

exchange.xforce.ibmcloud.com/vulnerabilities/43846

www.redhat.com/archives/fedora-package-announce/2008-July/msg00590.html

www.redhat.com/archives/fedora-package-announce/2008-July/msg00652.html

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

AI Score

5.6

Confidence

High

EPSS

0.002

Percentile

62.6%

JSON

Related for NVD:CVE-2008-3197

nessus5 redhatcve1 openvas8 prion1 phpmyadmin1 cvelist1 ubuntucve1 debiancve1 cve1 osv1 debian1 securityvulns2