Lucene search

PhpMyAdminPHPMYADMIN:PMASA-2006-7

HistoryNov 17, 2006 - 12:00 a.m.

XSS vulnerability

2006-11-1700:00:00

www.phpmyadmin.net

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.008

Percentile

82.3%

JSON

PMASA-2006-7

Announcement-ID: PMASA-2006-7

Date: 2006-11-17

Summary

XSS vulnerability

Description

We received a security advisory from laurent gaffié and we wish to thank him for his work. It was possible to produce XSS via table and database comment field and through position parameter.

Severity

We consider this vulnerability to be serious.

Affected Versions

Probably all versions to 2.9.1.

Solution

Upgrade to phpMyAdmin 2.9.1.1 or newer.

References

Assigned CVE ids: CVE-2006-6942

CWE ids: CWE-661 CWE-79

Patches

The following commits have been made to fix this issue:

59d245f36ab4e0b8a49c44b1f9045fc9aef939b2

More information

For further information and in case of questions, please contact the phpMyAdmin team. Our website is phpmyadmin.net.

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.008

Percentile

82.3%

JSON

Related for PHPMYADMIN:PMASA-2006-7