Vulnerability Description
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tbl_get_field.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger the XSS attack.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Phpmyadmin | Phpmyadmin | >= 4.0.0, < 4.9.5 |
| Debian | Debian Linux | 8.0 |
| Fedoraproject | Fedora | 30 |
| Opensuse | Backports Sle | 15.0 |
| Opensuse | Leap | 15.1 |
| Suse | Package Hub | - |
| Suse | Linux Enterprise | 12.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.htmlBroken LinkMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.htmlBroken LinkMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.htmlBroken LinkMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/03/msg00028.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://www.phpmyadmin.net/security/PMASA-2020-4/PatchVendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.htmlBroken LinkMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.htmlBroken LinkMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.htmlBroken LinkMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/03/msg00028.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
FAQ
What is CVE-2020-10803?
CVE-2020-10803 is a vulnerability with a CVSS score of 5.4 (MEDIUM). In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results ...
How severe is CVE-2020-10803?
CVE-2020-10803 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-10803?
Check the references section above for vendor advisories and patch information. Affected products include: Phpmyadmin Phpmyadmin, Debian Debian Linux, Fedoraproject Fedora, Opensuse Backports Sle, Opensuse Leap.