GitHub Advisoryadvisory · Packagist
GHSA-vcwc-6mr9-8m7c Cross-site Scripting in phpmyadmin
MEDIUM
Official page ↗
- Aliases
- CVE-2022-23808
- Ecosystem
- Packagist
- Packages
- phpmyadmin/phpmyadmin
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2022-01-28
Affected packages
• Packagist phpmyadmin/phpmyadmin: >= 5.1.0, < 5.1.2 → fixed in 5.1.2
Description
An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.
Related
Alias · CVE (1)
- CVE-2022-23808 An issue was discovered in phpMyAdmin 5.1 before 5.1.2. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-23808 advisory
- https://github.com/phpmyadmin/phpmyadmin/commit/44eb12f15a562718bbe54c9a16af91ceea335d59 web
- https://github.com/phpmyadmin/phpmyadmin/commit/5118acce1dfcdb09cbc0f73927bf51c46feeaf38 web
- https://github.com/phpmyadmin/phpmyadmin package
- https://infosecwriteups.com/exploit-cve-2022-23808-85041c6e5b97 web
- https://security.gentoo.org/glsa/202311-17 web
- https://www.phpmyadmin.net/security/PMASA-2022-2 web