Vulnerability Name:

CVE-2016-5705 (CCN-114751)

Assigned:2016-06-23
Published:2016-06-23
Updated:2018-10-30
Summary:Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) server-privileges certificate data fields on the user privileges page, (2) an "invalid JSON" error message in the error console, (3) a database name in the central columns implementation, (4) a group name, or (5) a search name in the bookmarks implementation.
CVSS v3 Severity:6.1 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
5.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:H/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
6.1 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
5.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:H/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
5.5 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-79
Vulnerability Consequences:Cross-Site Scripting
References:Source: MITRE
Type: CNA
CVE-2016-5705

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2016:1699

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2016:1700

Source: DEBIAN
Type: UNKNOWN
DSA-3627

Source: BID
Type: UNKNOWN
91378

Source: XF
Type: UNKNOWN
phpmyadmin-cve20165705-xss(114751)

Source: CONFIRM
Type: Patch
https://github.com/phpmyadmin/phpmyadmin/commit/03f73d48369703e0d3584699b08e24891c3295b8

Source: CONFIRM
Type: Patch
https://github.com/phpmyadmin/phpmyadmin/commit/0b7416c5f4439ed3f11c023785f2d4c49a1b09fc

Source: CONFIRM
Type: Patch
https://github.com/phpmyadmin/phpmyadmin/commit/364732e309cccb3fb56c938ed8d8bc0e04a3ca98

Source: CONFIRM
Type: Patch
https://github.com/phpmyadmin/phpmyadmin/commit/36df83a97a7f140fdb008b727a94f882847c6a6f

Source: CONFIRM
Type: Patch
https://github.com/phpmyadmin/phpmyadmin/commit/57ae483bad33059a885366d5445b7e1f6f29860a

Source: GENTOO
Type: UNKNOWN
GLSA-201701-32

Source: CCN
Type: phpMyAdmin Security Advisory PMASA-2016-21
Multiple XSS vulnerabilities

Source: CONFIRM
Type: Patch, Vendor Advisory
https://www.phpmyadmin.net/security/PMASA-2016-21/

Vulnerable Configuration:Configuration 1:
  • cpe:/o:opensuse:leap:42.1:*:*:*:*:*:*:*
  • OR cpe:/o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
  • OR cpe:/o:opensuse:opensuse:13.2:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*
  • OR cpe:/a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20165705
    V
    		CVE-2016-5705
    2022-06-30
    oval:org.opensuse.security:def:113141
    P
    		phpMyAdmin-4.6.5.2-1.1 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:106569
    P
    		phpMyAdmin-4.6.5.2-1.1 on GA media (Moderate)
    2021-10-01
    oval:org.cisecurity:def:1017
    P
    		DSA-3627-1 -- phpmyadmin -- security update
    2016-09-16
    oval:com.ubuntu.disco:def:201657050000000
    V
    		CVE-2016-5705 on Ubuntu 19.04 (disco) - medium.
    2016-07-03
    oval:com.ubuntu.bionic:def:201657050000000
    V
    		CVE-2016-5705 on Ubuntu 18.04 LTS (bionic) - medium.
    2016-07-03
    oval:com.ubuntu.xenial:def:201657050000000
    V
    		CVE-2016-5705 on Ubuntu 16.04 LTS (xenial) - medium.
    2016-07-03
    oval:com.ubuntu.artful:def:20165705000
    V
    		CVE-2016-5705 on Ubuntu 17.10 (artful) - medium.
    2016-07-02
    oval:com.ubuntu.trusty:def:20165705000
    V
    		CVE-2016-5705 on Ubuntu 14.04 LTS (trusty) - medium.
    2016-07-02
    oval:com.ubuntu.cosmic:def:201657050000000
    V
    		CVE-2016-5705 on Ubuntu 18.10 (cosmic) - medium.
    2016-07-02
    oval:com.ubuntu.bionic:def:20165705000
    V
    		CVE-2016-5705 on Ubuntu 18.04 LTS (bionic) - medium.
    2016-07-02
    oval:com.ubuntu.xenial:def:20165705000
    V
    		CVE-2016-5705 on Ubuntu 16.04 LTS (xenial) - medium.
    2016-07-02
    oval:com.ubuntu.cosmic:def:20165705000
    V
    		CVE-2016-5705 on Ubuntu 18.10 (cosmic) - medium.
    2016-07-02
    oval:com.ubuntu.precise:def:20165705000
    V
    		CVE-2016-5705 on Ubuntu 12.04 LTS (precise) - medium.
    2016-07-02
    BACK
    opensuse leap 42.1
    opensuse opensuse 13.1
    opensuse opensuse 13.2
    phpmyadmin phpmyadmin 4.6.0
    phpmyadmin phpmyadmin 4.6.0 alpha1
    phpmyadmin phpmyadmin 4.6.0 rc1
    phpmyadmin phpmyadmin 4.6.0 rc2
    phpmyadmin phpmyadmin 4.6.1
    phpmyadmin phpmyadmin 4.6.2
    phpmyadmin phpmyadmin 4.4.0
    phpmyadmin phpmyadmin 4.4.1
    phpmyadmin phpmyadmin 4.4.1.1
    phpmyadmin phpmyadmin 4.4.2
    phpmyadmin phpmyadmin 4.4.3
    phpmyadmin phpmyadmin 4.4.4
    phpmyadmin phpmyadmin 4.4.5
    phpmyadmin phpmyadmin 4.4.6
    phpmyadmin phpmyadmin 4.4.6.1
    phpmyadmin phpmyadmin 4.4.7
    phpmyadmin phpmyadmin 4.4.8
    phpmyadmin phpmyadmin 4.4.9
    phpmyadmin phpmyadmin 4.4.10
    phpmyadmin phpmyadmin 4.4.11
    phpmyadmin phpmyadmin 4.4.12
    phpmyadmin phpmyadmin 4.4.13
    phpmyadmin phpmyadmin 4.4.13.1
    phpmyadmin phpmyadmin 4.4.14.1
    phpmyadmin phpmyadmin 4.4.15
    phpmyadmin phpmyadmin 4.4.15.1
    phpmyadmin phpmyadmin 4.4.15.2
    phpmyadmin phpmyadmin 4.4.15.3
    phpmyadmin phpmyadmin 4.4.15.4
    phpmyadmin phpmyadmin 4.4.15.5
    phpmyadmin phpmyadmin 4.4.15.6
    phpmyadmin phpmyadmin 4.4.15.6
    phpmyadmin phpmyadmin 4.6.2