CVE-2018-7260
medium
CVSS v3
—
CVSS v2
—
VIR risk
5.5
Description
Cross-site scripting (XSS) vulnerability in db_central_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Predictions
Exploit likelihood
30%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2018-7260
Vendor advisory: arch — https://security.archlinux.org/ASA-201802-11
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| arch | fixed | 4.7.8-1 | |
| debian | bookworm | fixed | 4:4.9.1+dfsg1-2 |
| debian | bullseye | fixed | 4:4.9.1+dfsg1-2 |
| debian | sid | fixed | 4:4.9.1+dfsg1-2 |
| debian | trixie | fixed | 4:4.9.1+dfsg1-2 |
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Packagist | phpmyadmin/phpmyadmin | <4.7.8 | 4.7.8 |
References
- https://security.archlinux.org/ASA-201802-11
- https://nvd.nist.gov/vuln/detail/CVE-2018-7260
- https://github.com/phpmyadmin/phpmyadmin/commit/d2886a3
- https://github.com/phpmyadmin/composer
- https://udiniya.wordpress.com/2018/02/21/a-tale-of-stealing-session-cookie-in-phpmyadmin
- https://www.phpmyadmin.net/security/PMASA-2018-1
- http://www.securityfocus.com/bid/103099
- https://security-tracker.debian.org/tracker/CVE-2018-7260
Verify integrity in audit chain (admin only). AS-IS.