CVE-2013-3742: XSS

Published Jul 4, 2013

Updated

Cross-site scripting (XSS) vulnerability in viewcreate.php (aka the Create View page) in phpMyAdmin 4.x before 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via an invalid SQL CREATE VIEW statement with a crafted name that triggers an error message.

Affected Software

5 affected components

phpMyAdmin phpMyAdmin=4.0.0

phpMyAdmin phpMyAdmin=4.0.0-rc2

phpMyAdmin phpMyAdmin=4.0.0-rc3

phpMyAdmin phpMyAdmin=4.0.1

phpMyAdmin phpMyAdmin=4.0.2

Event History

Jul 4, 2013

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2013-3742?

CVE-2013-3742 is categorized as a medium severity vulnerability due to its potential for cross-site scripting attacks.

How do I fix CVE-2013-3742?

To fix CVE-2013-3742, upgrade to phpMyAdmin version 4.0.3 or later, which addresses this vulnerability.

Who is affected by CVE-2013-3742?

CVE-2013-3742 affects remote authenticated users of phpMyAdmin versions 4.0.0 up to 4.0.2.

What types of attacks are possible with CVE-2013-3742?

CVE-2013-3742 allows attackers to inject arbitrary web script or HTML through crafted SQL CREATE VIEW statements.

Is there a workaround for CVE-2013-3742?

Temporarily restricting access to the Create View page can help mitigate risks until an upgrade is performed.