JVNDB-2008-000061

phpMyAdmin cross-site scripting vulnerability

phpMyAdmin provided by The phpMyAdmin Project contains a cross-site scripting vulnerability.

phpMyAdmin provided by The phpMyAdmin Project is software to handle the administration of MySQL over the web browser. phpMyAdmin contains a cross-site scripting vulnerability.

Masako Oono of NetAgent Co., Ltd. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Base Metrics: 4.3 (Medium) [IPA Score]

• Access Vector: Network
• Access Complexity: Medium
• Authentication: None
• Confidentiality Impact: None
• Integrity Impact: Partial
• Availability Impact: None

The phpMyAdmin Project

• phpMyAdmin 2.11.9.1 and earlier

An arbitrary script may be executed on the user's web browser.
According to the developer, Microsoft Internet Explorer is only affected by this vulnerability and it is confirmed that Mozilla Firefox, Google Chrome, Konqueror, and Apple Safari are not affected by this issue.
For more information, refer to the developer's website.

[Update the Software]
Apply the latest update provided by the developer.

The phpMyAdmin Project

• RELEASES : version 2.11.9.2
• SECURITY ANNOUNCEMENTS : PMASA-2008-8

1. JVN : JVN#54824688
2. National Vulnerability Database (NVD) : CVE-2008-4326
3. Common Vulnerabilities and Exposures (CVE) : CVE-2008-4326
4. VUPEN Security : VUPEN/ADV-2008-2657
5. Common Weakness Enumeration (CWE) : Cross-site scripting (CWE-79) [IPA Evaluation]
6. JVN iPedia (Japanese) : JVNDB-2008-000061

[2008/09/26]
  Web page published