PMASA-2006-1
Announcement-ID: PMASA-2006-1
Date: 2006-04-06
Summary
XSS vulnerabilities
Description
It was possible to conduct an XSS attack with a direct call to some scripts under the themes directory. We wish to thank Toni Koivunen/CERT-FI for this advisory.
Severity
We consider these vulnerabilities to be serious.
Affected Versions
All previous versions that support theming are affected.
Solution
Upgrade to phpMyAdmin 2.8.0.3 for the fixes in the two included themes. New versions of the custom themes will be posted on our themes download page.
References
Assigned CVE IDs: CVE-2006-1678
Patches
The following commits have been made to fix this issue:
More information
For further information and in case of questions, please contact the phpMyAdmin security team at security@phpmyadmin.net.