CVE-2012-5368 phpMyAdmin Unsafe Fetching of Javascript Code
Man-in-the-middle attackers can inject malicious JavaScript into phpMyAdmin sessions via unencrypted HTTP requests, leading to cross-site scripting attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2012-5368?
CVE-2012-5368 is a medium-severity cross-site scripting vulnerability in Phpmyadmin Phpmyadmin, published on 25 Oct 2012. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code.
Weakness: CWE-79
Which versions are affected by CVE-2012-5368?
2 open source packages ship an affected version, including phpmyadmin/phpmyadmin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
phpmyadmin/phpmyadmin Packagist | From 3.5 | 3.5.3 |
phpmyadmin/phpmyadmin Packagist | From 3.5 | 3.5.3 |
Products include Phpmyadmin Phpmyadmin.
How do I fix CVE-2012-5368?
Upgrade phpmyadmin/phpmyadmin to 3.5.3 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2012-5368 being exploited?
There is no known exploitation of CVE-2012-5368 in the wild and no public exploit code.
Other vulnerabilities in Phpmyadmin Phpmyadmin
Sources
Also known as GHSA-xpxp-v33m-5jp9.