CVE-2012-1190
published 2012-05-03CVE-2012-1190: Cross-site scripting (XSS) vulnerability in the replication-setup functionality in js/replication.js in phpMyAdmin 3.4.x before 3.4.10.1 allows user-assisted…
PriorityP419medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
2.23%
80.8th percentile
Cross-site scripting (XSS) vulnerability in the replication-setup functionality in js/replication.js in phpMyAdmin 3.4.x before 3.4.10.1 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted database name.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | phpmyadmin | < phpmyadmin 4:3.4.10.1-1 (bookworm) | phpmyadmin 4:3.4.10.1-1 (bookworm) |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | >= 0 < 4:3.4.10.1-1 | 4:3.4.10.1-1 |
| phpmyadmin | phpmyadmin | >= 0 < 4:3.4.10.1-1 | 4:3.4.10.1-1 |
| phpmyadmin | phpmyadmin | >= 0 < 4:3.4.10.1-1 | 4:3.4.10.1-1 |
| phpmyadmin | phpmyadmin | >= 0 < 4:3.4.10.1-1 | 4:3.4.10.1-1 |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2012-1190: phpmyadmin - Cross-site scripting (XSS) vulnerability in the replication-setup functionality ...
vendor_debian·2012·CVSS 4.3
CVE-2012-1190 [MEDIUM] CVE-2012-1190: phpmyadmin - Cross-site scripting (XSS) vulnerability in the replication-setup functionality ...
Cross-site scripting (XSS) vulnerability in the replication-setup functionality in js/replication.js in phpMyAdmin 3.4.x before 3.4.10.1 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted database name.
Scope: local
bookworm: resolved (fixed in 4:3.4.10.1-1)
bullseye: resolved (fixed in 4:3.4.10.1-1)
forky: resolved (fixed in 4:3.4.10.1-1)
sid: resolved (fixed in 4:3.4.10.1-1)
trixie: resolved (fixed in 4:3.4.10.1-1)
GHSA
GHSA-2xg6-qhwr-gp7p: Cross-site scripting (XSS) vulnerability in the replication-setup functionality in js/replication
ghsa_unreviewed·2022-05-14
CVE-2012-1190 [MEDIUM] CWE-79 GHSA-2xg6-qhwr-gp7p: Cross-site scripting (XSS) vulnerability in the replication-setup functionality in js/replication
Cross-site scripting (XSS) vulnerability in the replication-setup functionality in js/replication.js in phpMyAdmin 3.4.x before 3.4.10.1 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted database name.
OSV
CVE-2012-1190: Cross-site scripting (XSS) vulnerability in the replication-setup functionality in js/replication
osv·2012-05-03·CVSS 4.3
CVE-2012-1190 [MEDIUM] CVE-2012-1190: Cross-site scripting (XSS) vulnerability in the replication-setup functionality in js/replication
Cross-site scripting (XSS) vulnerability in the replication-setup functionality in js/replication.js in phpMyAdmin 3.4.x before 3.4.10.1 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted database name.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-1457 clamav: overly long length field in tar files evade detection
bugzilla·2012-03-22·CVSS 4.3
CVE-2012-1457 [MEDIUM] CVE-2012-1457 clamav: overly long length field in tar files evade detection
CVE-2012-1457 clamav: overly long length field in tar files evade detection
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-1457 to
the following vulnerability:
Name: CVE-2012-1457
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1457
Assigned: 20120229
Reference: BUGTRAQ:20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products
Reference: http://www.securityfocus.com/archive/1/522005
Reference: http://www.ieee-security.org/TC/SP2012/program.html
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK
2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus
10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00,
ClamAV 0.96.4, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware
5.1.0.1, eSafe 7.
Bugzilla
CVE-2012-1190 phpMyAdmin: XSS in replication setup (PMASA-2012-1) [epel-6]
bugzilla·2012-02-18·CVSS 4.3
CVE-2012-1190 [MEDIUM] CVE-2012-1190 phpMyAdmin: XSS in replication setup (PMASA-2012-1) [epel-6]
CVE-2012-1190 phpMyAdmin: XSS in replication setup (PMASA-2012-1) [epel-6]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&
Bugzilla
CVE-2012-1190 phpMyAdmin: XSS in replication setup (PMASA-2012-1) [epel-5]
bugzilla·2012-02-18·CVSS 4.3
CVE-2012-1190 [MEDIUM] CVE-2012-1190 phpMyAdmin: XSS in replication setup (PMASA-2012-1) [epel-5]
CVE-2012-1190 phpMyAdmin: XSS in replication setup (PMASA-2012-1) [epel-5]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&
Bugzilla
CVE-2012-1190 phpMyAdmin: XSS in replication setup (PMASA-2012-1)
bugzilla·2012-02-18·CVSS 4.3
CVE-2012-1190 [MEDIUM] CVE-2012-1190 phpMyAdmin: XSS in replication setup (PMASA-2012-1)
CVE-2012-1190 phpMyAdmin: XSS in replication setup (PMASA-2012-1)
It was reported [1] that phpMyAdmin 3.4.x suffered from an XSS in replication setup, that could allow a malicious user to conduct an XSS attack using a crafted database name. All 3.4.x versions are affected, and this is fixed in upstream 3.4.10.1 [2].
[1] http://www.phpmyadmin.net/home_page/security/PMASA-2012-1.php
[2] https://github.com/phpmyadmin/phpmyadmin/commit/86073d532aed656550cb731aa5b4288b126ae7a6
Discussion:
Created phpMyAdmin tracking bugs for this issue
Affects: fedora-all [bug 795021]
Affects: epel-6 [bug 795022]
---
Created phpMyAdmin3 tracking bugs for this issue
Affects: epel-5 [bug 795023]
---
phpMyAdmin-3.5.0-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist,
Bugzilla
CVE-2012-1190 phpMyAdmin: XSS in replication setup (PMASA-2012-1) [fedora-all]
bugzilla·2012-02-18·CVSS 4.3
CVE-2012-1190 [MEDIUM] CVE-2012-1190 phpMyAdmin: XSS in replication setup (PMASA-2012-1) [fedora-all]
CVE-2012-1190 phpMyAdmin: XSS in replication setup (PMASA-2012-1) [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=secur
http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079435.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-May/079475.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-May/079566.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2012:050http://www.phpmyadmin.net/home_page/security/PMASA-2012-1.phphttp://www.securityfocus.com/bid/52857https://exchange.xforce.ibmcloud.com/vulnerabilities/75304https://github.com/phpmyadmin/phpmyadmin/commit/86073d532aed656550cb731aa5b4288b126ae7a6http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079435.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-May/079475.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-May/079566.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2012:050http://www.phpmyadmin.net/home_page/security/PMASA-2012-1.phphttp://www.securityfocus.com/bid/52857https://exchange.xforce.ibmcloud.com/vulnerabilities/75304https://github.com/phpmyadmin/phpmyadmin/commit/86073d532aed656550cb731aa5b4288b126ae7a6
2012-05-03
Published