Stored cross-site scripting in phpMyAdmin - CVE-2018-12581

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU13417

Stored cross-site scripting in phpMyAdmin - CVE-2018-12581

Published: June 21, 2018


Vulnerability identifier: #VU13417
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2018-12581
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data within Designer feature. A remote attacker create database with a specially crafted name and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


Affected software

phpMyAdmin
phpmyadmin (Alpine package)
phpMyAdmin
Oracle Communications Network Integrity
SUSE Linux
Fedora
Oracle Retail Markdown Optimization
Oracle Retail Clearance Optimization Engine
Oracle Retail Xstore Point of Service

How to mitigate CVE-2018-12581

Update to 4.8.2.

phpMyAdmin - update to 4.8.2
phpmyadmin (Alpine package) - update to 4.8.2-r0
phpMyAdmin - update to 4.8.2-1.fc28

External References

Related Security Bulletins