Vulnerability Details CVE-2016-2043
Cross-site scripting (XSS) vulnerability in the goToFinish1NF function in js/normalization.js in phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a table name to the normalization page.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 64.3%
CVSS Severity
CVSS v3 Score 5.4
CVSS v2 Score 3.5
References
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html
- http://www.phpmyadmin.net/home_page/security/PMASA-2016-7.php
- https://github.com/phpmyadmin/phpmyadmin/commit/019c4f25d500ec5db9ba3b84cc961a7e4e850738
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html
- http://www.phpmyadmin.net/home_page/security/PMASA-2016-7.php
- https://github.com/phpmyadmin/phpmyadmin/commit/019c4f25d500ec5db9ba3b84cc961a7e4e850738
Products affected by CVE-2016-2043
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.1
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.2
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.1
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.2
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.3
-
cpe:2.3:o:fedoraproject:fedora:22
-
cpe:2.3:o:fedoraproject:fedora:23
-
cpe:2.3:o:opensuse:leap:42.1
-
cpe:2.3:o:opensuse:opensuse:13.1
-
cpe:2.3:o:opensuse:opensuse:13.2