PT-2014-2151 · Phpmyadmin · Phpmyadmin

Jan Lieskovsky · Publicado 2014-12-26 · Atualizado 2022-05-17 · CVE-2011-3592

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 3.4.x through 3.4.4

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the PMA unInlineEditRow function. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via the database name, table name, or column name that is not properly handled after an inline-editing operation.

Recommendations For phpMyAdmin versions 3.4.x through 3.4.4, update to version 3.4.5 or later to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2011-3592

GHSA-5P69-RMX8-7GW7

Produtos afetados

Phpmyadmin

Referências · 12

• https://github.com/phpmyadmin/phpmyadmin/commit/2f28ce9c800274190418da0945ce3647d36e1db6 · Nota
• https://github.com/phpmyadmin/phpmyadmin/commit/bda213c58aec44925be661acb0e76c19483ea170 · Nota
• https://github.com/phpmyadmin/composer · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=738681 · Nota
• https://security-tracker.debian.org/tracker/CVE-2011-3592 · Aviso do Fabricante
• http://phpmyadmin.net/home_page/security/PMASA-2011-14.php · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2011/09/30/8 · Nota
• https://osv.dev/vulnerability/GHSA-5p69-rmx8-7gw7 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-3592 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3592 · Nota
• https://osv.dev/vulnerability/CVE-2011-3592 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-3592 · Aviso do Fabricante