CVE-2004-1055: XSS

Published Nov 24, 2004

Updated

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.6.0-pl2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the PmaAbsoluteUri parameter, (2) the zerorows parameter in readdump.php, (3) the confirm form, or (4) an error message generated by the internal phpMyAdmin parser.

Affected Software

17 affected components

phpMyAdmin phpMyAdmin=2.5.0

phpMyAdmin phpMyAdmin=2.5.5_rc1

phpMyAdmin phpMyAdmin=2.5.7_pl1

phpMyAdmin phpMyAdmin=2.5.5

phpMyAdmin phpMyAdmin=2.5.7

phpMyAdmin phpMyAdmin=2.5.6_rc1

phpMyAdmin phpMyAdmin=2.6.0_pl1

phpMyAdmin phpMyAdmin=2.5.2

phpMyAdmin phpMyAdmin=2.5.1

phpMyAdmin phpMyAdmin=2.6.0_pl2

phpMyAdmin phpMyAdmin=2.5.4

phpMyAdmin phpMyAdmin=2.5.5_rc2

phpMyAdmin phpMyAdmin=2.5.5_pl1

Gentoo Linux=1.4-rc1

Gentoo Linux=1.4-rc3

Gentoo Linux=1.4

Gentoo Linux=1.4-rc2

Event History

Nov 24, 2004

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-1055?

CVE-2004-1055 has a moderate severity level due to its potential to allow cross-site scripting attacks.

How do I fix CVE-2004-1055?

To fix CVE-2004-1055, you should update phpMyAdmin to version 2.6.0-pl3 or later, which addresses the vulnerability.

What systems are affected by CVE-2004-1055?

CVE-2004-1055 affects multiple versions of phpMyAdmin, particularly versions 2.6.0-pl2 and earlier.

What types of attacks are possible with CVE-2004-1055?

CVE-2004-1055 can allow attackers to execute arbitrary web scripts or HTML in the context of the user's browser.

Is CVE-2004-1055 still a risk today?

While CVE-2004-1055 is an old vulnerability, systems running affected versions without updates remain at risk.