phpmyadmin/composer · Security
phpMyAdmin Cross-site scripting (XSS) vulnerability
- GHSA ID
- GHSA-mwm8-36c5-j5cf
- CVE ID
- CVE-2016-5731
- Severity
- medium
- Published
- Updated
- CVSS
- 6.1 · CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS v3
- 6.1 · CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Description
Cross-site scripting (XSS) vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving an OpenID error message.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-5731 ↗
- https://github.com/phpmyadmin/phpmyadmin/commit/418aeea3d83b0b6021bac311d849570acfc6e48c ↗
- https://github.com/phpmyadmin/phpmyadmin/commit/94cf3864254ffaf3a69e97d8fc454888368b94ab ↗
- https://security.gentoo.org/glsa/201701-32 ↗
- http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html ↗
- http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html ↗
- http://www.debian.org/security/2016/dsa-3627 ↗
- https://github.com/phpmyadmin/phpmyadmin/commit/52e7898 ↗
- https://github.com/phpmyadmin/phpmyadmin/commit/5fefa51 ↗
- https://github.com/phpmyadmin/phpmyadmin/commit/78f6c54 ↗
- https://github.com/phpmyadmin/phpmyadmin/commit/d005ba6 ↗
- https://www.phpmyadmin.net/security/PMASA-2016-24 ↗
- https://github.com/advisories/GHSA-mwm8-36c5-j5cf ↗