CVE-2018-15605: phpMyAdmin Cross-site Scripting (XSS) in the import dialog
An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature.
Other sources
phpMyAdmin Cross-site Scripting (XSS) in the import dialog
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/phpmyadmin/phpmyadminto a version that resolves this vulnerability.Fixed in 4.8.3 - Upgrade
Upgrade
alpine/phpmyadminto a version that resolves this vulnerability.Fixed in 4.8.3-r0
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2018-15605.
What is the severity of CVE-2018-15605?
The severity of CVE-2018-15605 is medium, with a CVSS score of 6.1.
What is the affected software?
The affected software is phpMyAdmin versions up to and exclusive of 4.8.3.
How does the vulnerability in phpMyAdmin work?
The vulnerability in phpMyAdmin allows an attacker to use a crafted file to manipulate an authenticated user through the import feature, leading to a Cross-Site Scripting (XSS) attack.
Is there a fix available for CVE-2018-15605?
Yes, the fix for CVE-2018-15605 is included in phpMyAdmin version 4.8.3 and later.