REDHAT-BUG-808439: XSS

Published Mar 30, 2012

Updated

An cross-site scripting (XSS) flaw was found in the way phpPgAdmin, a web-based PostgreSQL database administration tool, performed presentation of the default list of functions, being present in the database, to the user upon request. A remote attacker could provide a specially-crafted web page, which once visited by an unsuspecting, valid phpPgAdmin user could lead to arbitrary HTML or web script execution in the context of logged in phpPgAdmin user.

References: [1] http://archives.postgresql.org/pgsql-announce/2012-03/msg00016.php [2] https://github.com/phppgadmin/phppgadmin/commit/e92a003624609a445c4cf57c9c3d1fcef0eae47c#diff-0

Upstream patch: [3] https://github.com/phppgadmin/phppgadmin/commit/74174ad639664b52cc1609ede0af8bc403e98a00

CVE request: [4] http://www.openwall.com/lists/oss-security/2012/03/28/11

CVE assignment: [5] http://www.openwall.com/lists/oss-security/2012/03/29/6

Affected Software

1 affected component

phpPgAdmin phpPgAdmin

Event History

Mar 30, 2012

Data Sourced

11:39 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-808439?

The severity of REDHAT-BUG-808439 is classified as a cross-site scripting (XSS) vulnerability.

How do I fix REDHAT-BUG-808439?

To fix REDHAT-BUG-808439, update phpPgAdmin to the latest version that contains patches for the XSS vulnerability.

What systems are affected by REDHAT-BUG-808439?

REDHAT-BUG-808439 affects the phpPgAdmin web-based PostgreSQL database administration tool.

Can REDHAT-BUG-808439 be exploited remotely?

Yes, REDHAT-BUG-808439 can be exploited by remote attackers through specially crafted web pages.

What is the impact of REDHAT-BUG-808439 on users?

The impact of REDHAT-BUG-808439 allows attackers to execute arbitrary scripts in the context of the user's browser.