CVE-2014-8958
published 2014-11-30CVE-2014-8958: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote…
PriorityP419medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
2.44%
82.5th percentile
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.
Affected
58 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | phpmyadmin | < phpmyadmin 4:4.2.12-1 (bookworm) | phpmyadmin 4:4.2.12-1 (bookworm) |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rpvm-cpgc-m3w7: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4
ghsa_unreviewed·2022-05-17
CVE-2014-8958 [MEDIUM] CWE-79 GHSA-rpvm-cpgc-m3w7: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.
OSV
CVE-2014-8958: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4
osv·2014-11-30·CVSS 4.3
CVE-2014-8958 [MEDIUM] CVE-2014-8958: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.
Debian
CVE-2014-8958: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4...
vendor_debian·2014·CVSS 4.3
CVE-2014-8958 [MEDIUM] CVE-2014-8958: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4...
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.
Scope: local
bookworm: resolved (fixed in 4:4.2.12-1)
bullseye: resolved (fixed in 4:4.2.12-1)
forky: resolved (fixed in 4:4.2.12-1)
sid: resolved (fixed in 4:4.2.12-1)
trixie: resolved (fixed in 4:4.2.12-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-8958 phpMyAdmin: Multiple XSS vulnerabilities (PMASA-2014-13)
bugzilla·2014-11-21·CVSS 4.3
CVE-2014-8958 [MEDIUM] CVE-2014-8958 phpMyAdmin: Multiple XSS vulnerabilities (PMASA-2014-13)
CVE-2014-8958 phpMyAdmin: Multiple XSS vulnerabilities (PMASA-2014-13)
Multiple XSS vlunerabilities were reported [1] in phpMyAdmin:
- With a crafted database, table or column name it is possible to trigger an XSS attack in the table browse page.
- With a crafted ENUM value it is possible to trigger XSS attacks in the table print view and zoom search pages.
- With a crafted value for font size it is possible to trigger an XSS attack in the home page.
[1]: http://www.phpmyadmin.net/home_page/security/PMASA-2014-13.php
Discussion:
Created phpMyAdmin tracking bugs for this issue:
Affects: fedora-all [bug 1166621]
Affects: epel-6 [bug 1166623]
Affects: epel-7 [bug 1166624]
---
Created phpMyAdmin4 tracking bugs for this issue:
Affects: epel-5 [bug 1166622]
---
phpMyAdmin-4.0.10.6-1.e
Bugzilla
CVE-2014-8958 phpMyAdmin4: phpMyAdmin: Multiple XSS vulnerabilities (PMASA-2014-13) [epel-5]
bugzilla·2014-11-21·CVSS 4.3
CVE-2014-8958 [MEDIUM] CVE-2014-8958 phpMyAdmin4: phpMyAdmin: Multiple XSS vulnerabilities (PMASA-2014-13) [epel-5]
CVE-2014-8958 phpMyAdmin4: phpMyAdmin: Multiple XSS vulnerabilities (PMASA-2014-13) [epel-5]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
epel-5 tracking bug for phpMyAdmin4:
Bugzilla
CVE-2014-8958 phpMyAdmin: Multiple XSS vulnerabilities (PMASA-2014-13) [epel-7]
bugzilla·2014-11-21·CVSS 4.3
CVE-2014-8958 [MEDIUM] CVE-2014-8958 phpMyAdmin: Multiple XSS vulnerabilities (PMASA-2014-13) [epel-7]
CVE-2014-8958 phpMyAdmin: Multiple XSS vulnerabilities (PMASA-2014-13) [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
epel-7 tracking bug for phpMyAdmin: see blocks bu
Bugzilla
CVE-2014-8958 phpMyAdmin: Multiple XSS vulnerabilities (PMASA-2014-13) [fedora-all]
bugzilla·2014-11-21·CVSS 4.3
CVE-2014-8958 [MEDIUM] CVE-2014-8958 phpMyAdmin: Multiple XSS vulnerabilities (PMASA-2014-13) [fedora-all]
CVE-2014-8958 phpMyAdmin: Multiple XSS vulnerabilities (PMASA-2014-13) [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versio
Bugzilla
CVE-2014-8958 phpMyAdmin: Multiple XSS vulnerabilities (PMASA-2014-13) [epel-6]
bugzilla·2014-11-21·CVSS 4.3
CVE-2014-8958 [MEDIUM] CVE-2014-8958 phpMyAdmin: Multiple XSS vulnerabilities (PMASA-2014-13) [epel-6]
CVE-2014-8958 phpMyAdmin: Multiple XSS vulnerabilities (PMASA-2014-13) [epel-6]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
epel-6 tracking bug for phpMyAdmin: see blocks bu
http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.htmlhttp://www.debian.org/security/2015/dsa-3382http://www.mandriva.com/security/advisories?name=MDVSA-2014:228http://www.phpmyadmin.net/home_page/security/PMASA-2014-13.phphttp://www.securityfocus.com/bid/71243https://github.com/phpmyadmin/phpmyadmin/commit/1bc04ec95038f2356ad33752090001bf1c047208https://github.com/phpmyadmin/phpmyadmin/commit/2a3b7393d1d5a8ba0543699df94a08a0f5728fe0https://github.com/phpmyadmin/phpmyadmin/commit/2ffdbf2d7daa0b92541d8b754e2afac555d3ed21https://github.com/phpmyadmin/phpmyadmin/commit/d32da348c4de2379482a48661ce968a55eebe5c4https://security.gentoo.org/glsa/201505-03http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.htmlhttp://www.debian.org/security/2015/dsa-3382http://www.mandriva.com/security/advisories?name=MDVSA-2014:228http://www.phpmyadmin.net/home_page/security/PMASA-2014-13.phphttp://www.securityfocus.com/bid/71243https://github.com/phpmyadmin/phpmyadmin/commit/1bc04ec95038f2356ad33752090001bf1c047208https://github.com/phpmyadmin/phpmyadmin/commit/2a3b7393d1d5a8ba0543699df94a08a0f5728fe0https://github.com/phpmyadmin/phpmyadmin/commit/2ffdbf2d7daa0b92541d8b754e2afac555d3ed21https://github.com/phpmyadmin/phpmyadmin/commit/d32da348c4de2379482a48661ce968a55eebe5c4https://security.gentoo.org/glsa/201505-03
2014-11-30
Published