PMASA-2018-3
Announcement-ID: PMASA-2018-3
Date: 2018-06-19
Updated: 2018-06-21
Summary
XSS in Designer feature
Description
A Cross-Site Scripting vulnerability was found in the Designer feature, where an attacker can deliver a payload to a user through a specially-crafted database name.
Severity
We consider this attack to be of moderate severity.
Affected Versions
phpMyAdmin versions prior to 4.8.2.
Solution
Upgrade to phpMyAdmin 4.8.2 or newer or apply patch listed below.
References
Thanks to William Desportes
Assigned CVE IDs: CVE-2018-12581
CWE IDs: CWE-661
Patches
The following commits have been made on the 4.8 branch to fix this issue:
More information
For further information and in case of questions, please contact the phpMyAdmin security team at security@phpmyadmin.net.