CVE-2013-4996: XSS

Published Jul 30, 2013

Updated

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted database name, (2) a crafted user name, (3) a crafted logo URL in the navigation panel, (4) a crafted entry in a certain proxy list, or (5) crafted content in a version.json file.

Affected Software

22 affected components

phpMyAdmin phpMyAdmin=3.5.0.0

phpMyAdmin phpMyAdmin=3.5.1.0

phpMyAdmin phpMyAdmin=3.5.2.0

phpMyAdmin phpMyAdmin=3.5.2.1

phpMyAdmin phpMyAdmin=3.5.2.2

phpMyAdmin phpMyAdmin=3.5.3.0

phpMyAdmin phpMyAdmin=3.5.4

phpMyAdmin phpMyAdmin=3.5.5

phpMyAdmin phpMyAdmin=3.5.6

phpMyAdmin phpMyAdmin=3.5.7

phpMyAdmin phpMyAdmin=3.5.7-rc1

phpMyAdmin phpMyAdmin=3.5.8

phpMyAdmin phpMyAdmin=3.5.8-rc1

phpMyAdmin phpMyAdmin=3.5.8.1

phpMyAdmin phpMyAdmin=4.0.0

phpMyAdmin phpMyAdmin=4.0.0-rc2

phpMyAdmin phpMyAdmin=4.0.0-rc3

phpMyAdmin phpMyAdmin=4.0.1

phpMyAdmin phpMyAdmin=4.0.2

phpMyAdmin phpMyAdmin=4.0.3

phpMyAdmin phpMyAdmin=4.0.4

phpMyAdmin phpMyAdmin=4.0.4.1

Event History

Jul 30, 2013

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2013-4996?

CVE-2013-4996 is considered a high severity vulnerability due to multiple cross-site scripting (XSS) vulnerabilities that could allow attackers to execute arbitrary scripts.

How do I fix CVE-2013-4996?

To fix CVE-2013-4996, upgrade phpMyAdmin to version 3.5.8.2 or 4.0.4.2 or later.

What versions of phpMyAdmin are affected by CVE-2013-4996?

CVE-2013-4996 affects phpMyAdmin versions 3.5.x prior to 3.5.8.2 and 4.0.x prior to 4.0.4.2.

What types of attacks are possible with CVE-2013-4996?

CVE-2013-4996 allows remote attackers to inject arbitrary web scripts or HTML into the application, leading to XSS attacks.

Is user input a factor in CVE-2013-4996?

Yes, CVE-2013-4996 exploits vulnerabilities when crafted database names, user names, or logo URLs are processed without proper sanitization.