PT-2014-2150 · Phpmyadmin · Phpmyadmin

Jan Lieskovsky · Published 2014-12-26 · Updated 2022-05-17 · CVE-2011-3591

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 3.4.x through 3.4.4

Description The issue allows remote authenticated users to inject arbitrary web script or HTML via a crafted row that triggers an improperly constructed confirmation message after inline-editing and save operations. This is related to the js/functions.js and js/tbl structure.js files.

Recommendations For phpMyAdmin versions 3.4.x through 3.4.4, update to version 3.4.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the js/functions.js and js/tbl structure.js files to minimize the risk of exploitation. Avoid using inline-editing and save operations until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2011-3591

GHSA-3P87-W3C5-27GF

Affected Products

Phpmyadmin

References · 11

• https://osv.dev/vulnerability/DEBIAN-CVE-2011-3591 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-3591 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3p87-w3c5-27gf · Vendor Advisory
• http://phpmyadmin.net/home_page/security/PMASA-2011-14.php · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-3591 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-3591 · Security Note
• https://github.com/phpmyadmin/phpmyadmin/commit/bda213c58aec44925be661acb0e76c19483ea170 · Note
• https://github.com/phpmyadmin/composer · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=738681 · Note
• http://openwall.com/lists/oss-security/2011/09/30/8 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3591 · Note