CVE-2016-2040

Published: 20 February 2016

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) table name, (2) SET value, (3) search query, or (4) hostname in a Location header.

Priority

Cvss 3 Severity Score

5.4

Score breakdown

Status

Package	Release	Status
phpmyadmin Launchpad, Ubuntu, Debian	artful	Not vulnerable (4:4.5.4-1)
	bionic	Not vulnerable (4:4.5.4-1)
	cosmic	Not vulnerable (4:4.5.4-1)
	disco	Not vulnerable (4:4.5.4-1)
	eoan	Does not exist
	focal	Not vulnerable (4:4.5.4-1)
	groovy	Not vulnerable (4:4.5.4-1)
	hirsute	Not vulnerable (4:4.5.4-1)
	impish	Not vulnerable (4:4.5.4-1)
	jammy	Not vulnerable (4:4.5.4-1)
	kinetic	Not vulnerable (4:4.5.4-1)
	lunar	Not vulnerable (4:4.5.4-1)
	mantic	Not vulnerable (4:4.5.4-1)
	precise	Ignored (end of life)
	trusty	Needed
	upstream	Released (4:4.5.4-1)
	vivid	Ignored (end of life)
	wily	Ignored (end of life)
	xenial	Not vulnerable (4:4.5.4-1)
	yakkety	Not vulnerable (4:4.5.4-1)
	zesty	Not vulnerable (4:4.5.4-1)
	Patches: upstream: https://github.com/phpmyadmin/phpmyadmin/commit/9f3488fc3ab6b83618dbb4bebbea4b973764e2ac upstream: https://github.com/phpmyadmin/phpmyadmin/commit/0ce4fd2750491a54d27f94cc1403f9da21738aa6 upstream: https://github.com/phpmyadmin/phpmyadmin/commit/27eb98faedcdcd0b856577fcbdfe3e87b2445345 upstream: https://github.com/phpmyadmin/phpmyadmin/commit/2b3f915f72bfe7eb9ae60a69582f041ddc55f663 upstream: https://github.com/phpmyadmin/phpmyadmin/commit/75de41635d387e1c3c8d71a746241502a90c8422 upstream: https://github.com/phpmyadmin/phpmyadmin/commit/1414d60cbfe01a2d08ab9d5e6a7178a6323fca68 upstream: https://github.com/phpmyadmin/phpmyadmin/commit/75a55824012406a08c4debf5ddb7ae41c32a7dbc upstream: https://github.com/phpmyadmin/phpmyadmin/commit/edffb52884b09562490081c3b8666ef46c296418 upstream: https://github.com/phpmyadmin/phpmyadmin/commit/aca42efa01917cc0fe8cfdb2927a6399ca1742f2

Severity score breakdown

Parameter	Value
Base score	5.4
Attack vector	Network
Attack complexity	Low
Privileges required	Low
User interaction	Required
Scope	Changed
Confidentiality	Low
Integrity impact	Low
Availability impact	None
Vector	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›