CVE-2018-12581
Published: 21 June 2018
An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer feature.
From the Ubuntu Security Team
It was discovered phpmyadmin incorrectly handled database names. An attacker could possibly use this to trigger an XSS attack.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
phpmyadmin
Launchpad, Ubuntu, Debian |
artful |
Ignored
(end of life)
|
| bionic |
Released
(4:4.6.6-5ubuntu0.5+esm1)
Available with Ubuntu Pro |
|
| cosmic |
Ignored
(end of life)
|
|
| disco |
Ignored
(end of life)
|
|
| eoan |
Does not exist
|
|
| focal |
Not vulnerable
(4:4.9.2+dfsg1-1)
|
|
| groovy |
Not vulnerable
(4:4.9.2+dfsg1-1)
|
|
| hirsute |
Not vulnerable
(4:4.9.2+dfsg1-1)
|
|
| impish |
Not vulnerable
(4:4.9.2+dfsg1-1)
|
|
| jammy |
Not vulnerable
(4:4.9.2+dfsg1-1)
|
|
| kinetic |
Not vulnerable
(4:4.9.2+dfsg1-1)
|
|
| lunar |
Not vulnerable
(4:4.9.2+dfsg1-1)
|
|
| trusty |
Released
(4:4.0.10-1ubuntu0.1+esm1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| upstream |
Released
(4.8.2, 4:4.9.1+dfsg1-2)
|
|
| xenial |
Released
(4:4.5.4.1-2ubuntu2.1+esm3)
Available with Ubuntu Pro |
|
|
Patches:
upstream: https://github.com/phpmyadmin/phpmyadmin/commit/6943fff87324bd54c3a37a5160a5fb77498c355e |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 6.1 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Changed |
| Confidentiality | Low |
| Integrity impact | Low |
| Availability impact | None |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |