GHSA-vcwc-6mr9-8m7c

Cross-site Scripting in phpmyadmin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-23808

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	phpmyadmin/phpmyadmin	>= 5.1.0, < 5.1.2	5.1.2

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-23808 advisory
https://github.com/phpmyadmin/phpmyadmin/commit/44eb12f15a562718bbe54c9a16af91ceea335d59 web
https://github.com/phpmyadmin/phpmyadmin/commit/5118acce1dfcdb09cbc0f73927bf51c46feeaf38 web
https://github.com/phpmyadmin/phpmyadmin package
https://infosecwriteups.com/exploit-cve-2022-23808-85041c6e5b97 web
https://security.gentoo.org/glsa/202311-17 web
https://www.phpmyadmin.net/security/PMASA-2022-2 web