Updated phpmyadmin packages fix CVE-2014-4349

2014-06-2719:03:09

Gentoo Foundation

advisories.mageia.org

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

0.002

Percentile

51.9%

JSON

Updated phpmyadmin packages fix security vulnerability: In phpMyAdmin before 4.1.14, it is possible to trigger an XSS when hiding or unhiding a crafted table name in the navigation, due to unescaped HTML output in the navigation items hiding feature. Note that this vulnerability can only be triggered by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form (CVE-2014-4349).

OSVersionArchitecturePackageVersionFilename
Mageia3noarchphpmyadmin< 4.1.14.1-1phpmyadmin-4.1.14.1-1.mga3
Mageia4noarchphpmyadmin< 4.1.14.1-1phpmyadmin-4.1.14.1-1.mga4