PT-2005-4422 · Phpmyadmin · Phpmyadmin

Stefan Esser · Published 2005-12-08 · Updated 2018-10-19 · CVE-2005-3665

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions prior to 2.7.0

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The vulnerabilities are related to the HTTP HOST variable and various scripts in the libraries directory that handle header generation.

Recommendations For versions prior to 2.7.0, update to version 2.7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the libraries directory and validating the HTTP HOST variable to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-3665

DSA-1207-1

Affected Products

Phpmyadmin

References · 15

• http://securityfocus.com/archive/1/423142/100/0/threaded · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2005-3665 · Vendor Advisory
• http://phpmyadmin.net/home_page/security.php?issue=PMASA-2005-8 · Vendor Advisory
• http://secunia.com/advisories/17895 · Vendor Advisory
• http://debian.org/security/2006/dsa-1207 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-3665 · Vendor Advisory
• http://securityfocus.com/bid/15735 · Patch
• http://gentoo.org/security/en/glsa/glsa-200512-03.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3665 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2005-3665 · Vendor Advisory
• http://vupen.com/english/advisories/2005/2772 · Note
• http://secunia.com/advisories/18618 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3665 · Note
• http://secunia.com/advisories/22781 · Note
• http://secunia.com/advisories/17957 · Note