GitHub Advisoryadvisory · Packagist

GHSA-xpxp-v33m-5jp9 phpMyAdmin Unsafe Fetching of Javascript Code

MEDIUM Published 2022-05-17 Modified 2023-08-15 Official page ↗
Aliases
CVE-2012-5368
Ecosystem
Packagist
Packages
phpmyadmin/phpmyadmin
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2023-08-15

Affected packages

• Packagist phpmyadmin/phpmyadmin: >= 3.5, < 3.5.3 → fixed in 3.5.3

Description

phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code.

Related

Alias · CVE (1)

  • CVE-2012-5368 phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References