CVE-2020-10803

Published: 22 March 2020

In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tbl_get_field.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger the XSS attack.

From the Ubuntu security team

It was discovered that phpMyAdmin did not properly handle data from the database when displaying it. If an attacker were to insert specially-crafted data into certain database tables, the attacker could execute a cross-site scripting (XSS) attack.

Priority

Medium

CVSS 3 base score: 5.4

Status

Package Release Status
phpmyadmin
Launchpad, Ubuntu, Debian
Upstream
Released (4:4.6.6-4+deb9u1, 4:4.9.5+dfsg1-1)
Ubuntu 21.04 (Hirsute Hippo) Not vulnerable
(4:4.9.5+dfsg1-1ubuntu1)
Ubuntu 20.10 (Groovy Gorilla) Not vulnerable
(4:4.9.5+dfsg1-1ubuntu1)
Ubuntu 20.04 LTS (Focal Fossa) Not vulnerable
(4:4.9.5+dfsg1-1ubuntu1)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (4:4.6.6-5ubuntu0.5)
Ubuntu 16.04 ESM (Xenial Xerus) Ignored
(end of standard support, was needed)
Ubuntu 14.04 ESM (Trusty Tahr) Needed