Detections
Analytics
FreeBSD : phpMyAdmin -- two XSS vulnerabilities due to unescaped db/table names (c4892644-f8c6-11e3-9f45-6805ca0b3d42)
low Nessus Plugin ID 76177
Language:
Synopsis
The remote FreeBSD host is missing a security-related update.Description
The phpMyAdmin development team reports :Self-XSS due to unescaped HTML output in recent/favorite tables navigation.
When marking a crafted database or table name as favorite or having it in recent tables, it is possible to trigger an XSS.
This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form.
Self-XSS due to unescaped HTML output in navigation items hiding feature.
When hiding or unhiding a crafted table name in the navigation, it is possible to trigger an XSS.
This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form.
Solution
Update the affected package.See Also
https://www.phpmyadmin.net/security/PMASA-2014-2/
Plugin Details
Severity: Low
ID: 76177
File Name: freebsd_pkg_c4892644f8c611e39f456805ca0b3d42.nasl
Version: 1.7
Type: local
Family: FreeBSD Local Security Checks
Published: 6/23/2014
Updated: 1/6/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.8
CVSS v2
Risk Factor: Low
Base Score: 3.5
Vector: CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:N
Vulnerability Information
CPE: p-cpe:/a:freebsd:freebsd:phpmyadmin, cpe:/o:freebsd:freebsd
Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info
Patch Publication Date: 6/20/2014
Vulnerability Publication Date: 6/20/2014
Reference Information
CVE: CVE-2014-4348, CVE-2014-4349