CVE-2018-12581: phpMyAdmin XSS Vulnerability
An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer feature.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/phpmyadmin/phpmyadminto a version that resolves this vulnerability.Fixed in 4.8.2 - Upgrade
Upgrade
alpine/phpmyadminto a version that resolves this vulnerability.Fixed in 4.8.2-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2018-12581?
The severity of CVE-2018-12581 is medium with a CVSS score of 6.1.
How can I fix the CVE-2018-12581 vulnerability?
To fix the CVE-2018-12581 vulnerability, you should upgrade phpMyAdmin to version 4.8.2 or later.
What is the CWE ID for CVE-2018-12581?
The CWE ID for CVE-2018-12581 is CWE-79.
Where can I find more information about CVE-2018-12581?
You can find more information about CVE-2018-12581 on the NIST NVD website, the phpMyAdmin security advisory, and the phpMyAdmin GitHub commit.
What is the vulnerability description of CVE-2018-12581?
CVE-2018-12581 is a Cross-Site Scripting vulnerability in phpMyAdmin before version 4.8.2 where an attacker can trigger an XSS attack using a crafted database name in the Designer feature.