Self XSS

PMASA-2016-16

Announcement-ID: PMASA-2016-16

Date: 2016-05-25

Updated: 2016-05-26

Summary

Self XSS

Description

A specially crafted attack could allow for special HTML characters to be passed as URL encoded values and displayed back as special characters in the page.

Updated to include CVE ID.

Severity

We consider this to be non-critical.

Affected Versions

Versions 4.4.x (prior to 4.4.15.6) and 4.6.x (prior to 4.6.2) are affected.

Solution

Upgrade to phpMyAdmin 4.4.15.6 or 4.6.2 or newer or apply patch listed below.

References

This issue was found thanks to Mozilla SOS program.

Assigned CVE ids: CVE-2016-5099

CWE ids: CWE-661

Patches

The following commits have been made on the 4.6 branch to fix this issue:

• b061096abd992801fbbd805ef6ff74e627528780

The following commits have been made on the 4.4 branch to fix this issue:

• 78e71897be0902eb1d5d3d30a33b4417cd7d4d87

More information

For further information and in case of questions, please contact the phpMyAdmin team. Our website is phpmyadmin.net.