CVE-2016-2040 — MEDIUM (5.4)

Vulnerability Description

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) table name, (2) SET value, (3) search query, or (4) hostname in a Location header.

CVSS Score

5.4

MEDIUM

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Fedoraproject	Fedora	22
Opensuse	Leap	42.1
Opensuse	Opensuse	13.1
Phpmyadmin	Phpmyadmin	4.0.0

Related Weaknesses (CWE)

CWE-79

References

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.hThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.hThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.htmlThird Party Advisory
http://www.debian.org/security/2016/dsa-3627
http://www.phpmyadmin.net/home_page/security/PMASA-2016-3.phpPatchVendor Advisory
https://github.com/phpmyadmin/phpmyadmin/commit/75a55824012406a08c4debf5ddb7ae41Patch
https://github.com/phpmyadmin/phpmyadmin/commit/aca42efa01917cc0fe8cfdb2927a6399Patch
https://github.com/phpmyadmin/phpmyadmin/commit/edffb52884b09562490081c3b8666ef4Patch
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.hThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.hThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.htmlThird Party Advisory
http://www.debian.org/security/2016/dsa-3627
http://www.phpmyadmin.net/home_page/security/PMASA-2016-3.phpPatchVendor Advisory

FAQ

What is CVE-2016-2040?

CVE-2016-2040 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script ...

How severe is CVE-2016-2040?

CVE-2016-2040 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2016-2040?

Check the references section above for vendor advisories and patch information. Affected products include: Fedoraproject Fedora, Opensuse Leap, Opensuse Opensuse, Phpmyadmin Phpmyadmin.