CVE-2008-3457
published 2008-08-04CVE-2008-3457: Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin before 2.11.8 allows user-assisted remote attackers to inject arbitrary web script or HTML…
PriorityP411low2.6CVSS 2.0
AVNACHAuNCNIPAN
EPSS
1.80%
76.3th percentile
Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin before 2.11.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted setup arguments. NOTE: this issue can only be exploited in limited scenarios in which the attacker must be able to modify config/config.inc.php.
Affected
47 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | phpmyadmin | < phpmyadmin 4:2.11.8~rc1-1 (bookworm) | phpmyadmin 4:2.11.8~rc1-1 (bookworm) |
| phpmyadmin | phpmyadmin | <= 2.11.7.0 | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
CVSS provenance
nvdv2.02.6LOWAV:N/AC:H/Au:N/C:N/I:P/A:N
osv2.6LOW
vendor_redhat6.4MEDIUM
vendor_debian2.6LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2008-3457: phpmyadmin - Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin before 2.11....
vendor_debian·2008·CVSS 2.6
CVE-2008-3457 [LOW] CVE-2008-3457: phpmyadmin - Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin before 2.11....
Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin before 2.11.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted setup arguments. NOTE: this issue can only be exploited in limited scenarios in which the attacker must be able to modify config/config.inc.php.
Scope: local
bookworm: resolved (fixed in 4:2.11.8~rc1-1)
bullseye: resolved (fixed in 4:2.11.8~rc1-1)
forky: resolved (fixed in 4:2.11.8~rc1-1)
sid: resolved (fixed in 4:2.11.8~rc1-1)
trixie: resolved (fixed in 4:2.11.8~rc1-1)
Red Hat
phpMyAdmin: Cross-site Framing; XSS in setup.php (PMASA-2008-6 - CVE-2008-3456, CVE-2008-3457)
vendor_redhat·CVSS 6.4
CVE-2008-3456 [MEDIUM] phpMyAdmin: Cross-site Framing; XSS in setup.php (PMASA-2008-6 - CVE-2008-3456, CVE-2008-3457)
phpMyAdmin: Cross-site Framing; XSS in setup.php (PMASA-2008-6 - CVE-2008-3456, CVE-2008-3457)
phpMyAdmin before 2.11.8 does not sufficiently prevent its pages from using frames that point to pages in other domains, which makes it easier for remote attackers to conduct spoofing or phishing activities via a cross-site framing attack.
GHSA
GHSA-gcf3-96cg-hh53: Cross-site scripting (XSS) vulnerability in setup
ghsa_unreviewed·2022-05-02
CVE-2008-3457 [LOW] CWE-79 GHSA-gcf3-96cg-hh53: Cross-site scripting (XSS) vulnerability in setup
Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin before 2.11.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted setup arguments. NOTE: this issue can only be exploited in limited scenarios in which the attacker must be able to modify config/config.inc.php.
OSV
CVE-2008-3457: Cross-site scripting (XSS) vulnerability in setup
osv·2008-08-04·CVSS 2.6
CVE-2008-3457 [LOW] CVE-2008-3457: Cross-site scripting (XSS) vulnerability in setup
Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin before 2.11.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted setup arguments. NOTE: this issue can only be exploited in limited scenarios in which the attacker must be able to modify config/config.inc.php.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.htmlhttp://secunia.com/advisories/31263http://secunia.com/advisories/31312http://secunia.com/advisories/32834http://www.debian.org/security/2008/dsa-1641http://www.mandriva.com/security/advisories?name=MDVSA-2008:202http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-6http://www.securityfocus.com/bid/30420http://www.vupen.com/english/advisories/2008/2226/referenceshttp://yehg.net/lab/pr0js/advisories/XSS_inPhpMyAdmin2.11.7.pdfhttps://exchange.xforce.ibmcloud.com/vulnerabilities/44052https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01239.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-July/msg01316.htmlhttp://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.htmlhttp://secunia.com/advisories/31263http://secunia.com/advisories/31312http://secunia.com/advisories/32834http://www.debian.org/security/2008/dsa-1641http://www.mandriva.com/security/advisories?name=MDVSA-2008:202http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-6http://www.securityfocus.com/bid/30420http://www.vupen.com/english/advisories/2008/2226/referenceshttp://yehg.net/lab/pr0js/advisories/XSS_inPhpMyAdmin2.11.7.pdfhttps://exchange.xforce.ibmcloud.com/vulnerabilities/44052https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01239.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-July/msg01316.html
2008-08-04
Published