Cross-site scripting in phpMyAdmin - CVE-2016-6615
Published: December 11, 2016 / Updated: August 4, 2020
Vulnerability identifier: #VU33614
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2016-6615
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
XSS issues were discovered in phpMyAdmin. This affects navigation pane and database/table hiding feature (a specially-crafted database name can be used to trigger an XSS attack); the "Tracking" feature (a specially-crafted query can be used to trigger an XSS attack); and GIS visualization feature. All 4.6.x versions (prior to 4.6.4) and 4.4.x versions (prior to 4.4.15.8) are affected.
Affected software
phpMyAdmin
phpmyadmin (Alpine package)
Opensuse
phpmyadmin (Alpine package)
Opensuse
How to mitigate CVE-2016-6615
Install update from vendor's website.
phpmyadmin (Alpine package) - update to 4.4.15.8-r0