Skip to content
OpenAdvisories
Medium · 6.1 CVE-2016-5731 EUVD-2022-4639GHSA-mwm8-36c5-j5cf

phpMyAdmin Cross-site scripting (XSS) vulnerability

Published Jul 3, 2016 · Updated Aug 6, 2024 · Assigned by mitre

Package: phpmyadmin Package: phpmyadmin Package: phpmyadmin/phpmyadmin Ecosystem: Debian Ecosystem: Packagist Ecosystem: Ubuntu

Description

Cross-site scripting (XSS) vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving an OpenID error message.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 phpmyadmin 4:4.6.3-1 —
Debian 13 phpmyadmin 4:4.6.3-1 —
Debian 12 phpmyadmin 4:4.6.3-1 —
Debian 8 phpmyadmin 4:4.2.12-2+deb8u2 DSA-3627-1
Debian 7 phpmyadmin 4:3.4.11.1-2+deb7u5 DLA-551-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS phpmyadmin No fix yet —
Ubuntu Pro 14.04 LTS phpmyadmin No fix yet —

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed phpMyAdmin 4.6.5.2-1.1 openSUSE-SU-2024:10054-1

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist phpmyadmin/phpmyadmin >= 4.0, < 4.0.10.16 4.0.10.16 GHSA-mwm8-36c5-j5cf
Packagist phpmyadmin/phpmyadmin >= 4.4, < 4.4.15.7 4.4.15.7 GHSA-mwm8-36c5-j5cf
Packagist phpmyadmin/phpmyadmin >= 4.6, < 4.6.3 4.6.3 GHSA-mwm8-36c5-j5cf

Advisories 3

References