XSS vulnerabilities

PMASA-2006-1

Announcement-ID: PMASA-2006-1

Date: 2006-04-06

Summary

XSS vulnerabilities

Description

It was possible to conduct an XSS attack with a direct call to some scripts under the themes directory. We wish to thank Toni Koivunen/CERT-FI for this advisory.

Severity

We consider these vulnerabilities to be serious.

Affected Versions

All previous versions that support theming are affected.

Solution

Upgrade to phpMyAdmin 2.8.0.3 for the fixes in the two included themes. New versions of the custom themes will be posted on our themes download page.

References

Assigned CVE ids: CVE-2006-1678

CWE ids: CWE-661 CWE-79

Patches

The following commits have been made to fix this issue:

• 0933619b6b2534b221817ea3f631cb984c258d6b

More information

For further information and in case of questions, please contact the phpMyAdmin team. Our website is phpmyadmin.net.