PMASA-2018-5
Announcement-ID: PMASA-2018-5
Date: 2018-08-21
Summary
XSS in the import dialog
Description
A Cross-Site Scripting vulnerability was found in the file import feature, where an attacker can deliver a payload to a user through importing a specially-crafted file.
Severity
We consider this attack to be of moderate severity.
Affected Versions
phpMyAdmin versions prior to 4.8.3
Solution
Upgrade to phpMyAdmin 4.8.3 or newer or apply patch listed below.
References
Assigned CVE IDs: CVE-2018-15605
CWE IDs: CWE-661
Patches
The following commits have been made on the 4.8 branch to fix this issue:
More information
For further information and in case of questions, please contact the phpMyAdmin security team at security@phpmyadmin.net.