PT-2020-5847 · Phpmyadmin+4 · Phpmyadmin+4

Giwan Go + 1 · Published 2020-10-10 · Updated 2024-06-15 · CVE-2020-26934

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: phpMyAdmin versions 4.9.6 and earlier, 5.x versions prior to 5.0.3

Description: The issue is related to the transformation feature in phpMyAdmin, which allows for cross-site scripting (XSS) attacks via a crafted link. This can enable a remote attacker to perform cross-site scripting attacks. The vulnerability is due to the lack of protection of the web page structure.

Recommendations: For phpMyAdmin versions 4.9.6 and earlier, update to version 4.9.6 or later. For 5.x versions prior to 5.0.3, update to version 5.0.3 or later. As a temporary workaround, consider disabling the transformation feature until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2020-3037

BDU:2021-01860

BIT-PHPMYADMIN-2020-26934

CVE-2020-26934

DLA-2413-1

GHSA-6349-53VR-7HCR

MGASA-2020-0383

OPENSUSE-SU-2020:1675-1

OPENSUSE-SU-2020:1806-1

OPENSUSE-SU-2020_1675-1

OPENSUSE-SU-2020_1806-1

OPENSUSE-SU-2024:11171-1

USN-4639-1

USN-4843-1

Affected Products

Alt Linux

Linuxmint

Suse

Ubuntu

Phpmyadmin

References · 102

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmyadmin/phpmyadmin/CVE-2020-26934.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmyadmin/phpmyadmin/CVE-2020-26935.yaml · Exploit
• https://ubuntu.com/security/CVE-2014-9218 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/TNLGHVDNAEZEGRTUESSSQFM7MZTHIDQ5 · Vendor Advisory
• https://phpmyadmin.net/security/PMASA-2020-5 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-7260 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-6630 · Vendor Advisory
• https://security.gentoo.org/glsa/202101-35 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PXK37YEHSDYCIPQSYEMN2OFTP2ZLM7DO · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9849 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0383.html · Security Note
• https://ubuntu.com/security/CVE-2019-12922 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-12616 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-1000015 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-26934 · Vendor Advisory