Vulnerability Name:

CVE-2013-4996 (CCN-86032)

Assigned:2013-07-28
Published:2013-07-28
Updated:2016-12-31
Summary:Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted database name, (2) a crafted user name, (3) a crafted logo URL in the navigation panel, (4) a crafted entry in a certain proxy list, or (5) crafted content in a version.json file.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.2 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-79
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2013-4996

Source: CCN
Type: SA54295
phpMyAdmin Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
59832

Source: CCN
Type: phpMyAdmin Web Site
phpMyAdmin

Source: CCN
Type: PMASA-2013-11
If a crafted version.json would be presented, an XSS could be introduced

Source: CONFIRM
Type: Vendor Advisory
http://www.phpmyadmin.net/home_page/security/PMASA-2013-11.php

Source: CCN
Type: PMASA-2013-9
5 XSS vulnerabilities in setup, chart display, process list, and logo link

Source: CONFIRM
Type: Vendor Advisory
http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php

Source: BID
Type: UNKNOWN
61921

Source: CCN
Type: BID-61921
phpMyAdmin CVE-2013-4996 Multiple Cross Site Scripting Vulnerabilities

Source: CCN
Type: Red Hat Bugzilla Bug 989657
(CVE-2013-4996, CVE-2013-4997) CVE-2013-4996 CVE-2013-4997 phpMyAdmin: Multiple (of both types, reflected and stored) XSS in various components (PMASA-2013-9 and PMASA-2013-11)

Source: XF
Type: UNKNOWN
phpmyadmin-cve20134996-multiple-xss(86032)

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2013-4996

Vulnerable Configuration:Configuration 1:
  • cpe:/a:phpmyadmin:phpmyadmin:3.5.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:3.5.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:3.5.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:3.5.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:3.5.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:3.5.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:3.5.4:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:3.5.5:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:3.5.6:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:3.5.7:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:3.5.7:rc1:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:3.5.8:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:3.5.8:rc1:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:3.5.8.1:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:phpmyadmin:phpmyadmin:3.5.0:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:3.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:3.5.2:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:3.5.4:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:3.5.5:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:3.5.6:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:3.5.7:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:3.5.8:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:3.5.8.1:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:3.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:113141
    P
    		phpMyAdmin-4.6.5.2-1.1 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:106569
    P
    		phpMyAdmin-4.6.5.2-1.1 on GA media (Moderate)
    2021-10-01
    oval:org.mitre.oval:def:24956
    P
    		DSA-2975-1 -- phpmyadmin - security update
    2014-10-06
    oval:com.ubuntu.precise:def:20134996000
    V
    		CVE-2013-4996 on Ubuntu 12.04 LTS (precise) - medium.
    2013-07-31
    oval:com.ubuntu.xenial:def:201349960000000
    V
    		CVE-2013-4996 on Ubuntu 16.04 LTS (xenial) - medium.
    2013-07-31
    oval:com.ubuntu.trusty:def:20134996000
    V
    		CVE-2013-4996 on Ubuntu 14.04 LTS (trusty) - medium.
    2013-07-31
    oval:com.ubuntu.xenial:def:20134996000
    V
    		CVE-2013-4996 on Ubuntu 16.04 LTS (xenial) - medium.
    2013-07-31
    BACK
    phpmyadmin phpmyadmin 3.5.0.0
    phpmyadmin phpmyadmin 3.5.1.0
    phpmyadmin phpmyadmin 3.5.2.0
    phpmyadmin phpmyadmin 3.5.2.1
    phpmyadmin phpmyadmin 3.5.2.2
    phpmyadmin phpmyadmin 3.5.3.0
    phpmyadmin phpmyadmin 3.5.4
    phpmyadmin phpmyadmin 3.5.5
    phpmyadmin phpmyadmin 3.5.6
    phpmyadmin phpmyadmin 3.5.7
    phpmyadmin phpmyadmin 3.5.7 rc1
    phpmyadmin phpmyadmin 3.5.8
    phpmyadmin phpmyadmin 3.5.8 rc1
    phpmyadmin phpmyadmin 3.5.8.1
    phpmyadmin phpmyadmin 4.0.0
    phpmyadmin phpmyadmin 4.0.0 rc2
    phpmyadmin phpmyadmin 4.0.0 rc3
    phpmyadmin phpmyadmin 4.0.1
    phpmyadmin phpmyadmin 4.0.2
    phpmyadmin phpmyadmin 4.0.3
    phpmyadmin phpmyadmin 4.0.4
    phpmyadmin phpmyadmin 4.0.4.1
    phpmyadmin phpmyadmin 3.5.0
    phpmyadmin phpmyadmin 3.5.1
    phpmyadmin phpmyadmin 3.5.2
    phpmyadmin phpmyadmin 3.5.4
    phpmyadmin phpmyadmin 3.5.5
    phpmyadmin phpmyadmin 3.5.6
    phpmyadmin phpmyadmin 3.5.7
    phpmyadmin phpmyadmin 4.0.2
    phpmyadmin phpmyadmin 4.0.1
    phpmyadmin phpmyadmin 4.0.0
    phpmyadmin phpmyadmin 4.0.3
    phpmyadmin phpmyadmin 4.0.4
    phpmyadmin phpmyadmin 3.5.8
    phpmyadmin phpmyadmin 3.5.8.1
    phpmyadmin phpmyadmin 3.5.3
    phpmyadmin phpmyadmin 4.0.4.1