CVE-2013-1937

Published: Apr 16, 2013Modified: Apr 29, 2026

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in tbl_gis_visualization.php in phpMyAdmin 3.5.x before 3.5.8 might allow remote attackers to inject arbitrary web script or HTML via the (1) visualizationSettings[width] or (2) visualizationSettings[height] parameter. NOTE: a third party reports that this is "not exploitable.

Affected (12)

Products: Phpmyadmin: Phpmyadmin

1 product

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Phpmyadmin Phpmyadmin	Up to 3.5.8
Phpmyadmin Phpmyadmin	Version 3.5.0.0
Phpmyadmin Phpmyadmin	Version 3.5.1.0
Phpmyadmin Phpmyadmin	Version 3.5.2.0
Phpmyadmin Phpmyadmin	Version 3.5.2.1
Phpmyadmin Phpmyadmin	Version 3.5.2.2
Phpmyadmin Phpmyadmin	Version 3.5.3.0
Phpmyadmin Phpmyadmin	Version 3.5.4
Phpmyadmin Phpmyadmin	Version 3.5.5
Phpmyadmin Phpmyadmin	Version 3.5.6
Phpmyadmin Phpmyadmin	Version 3.5.7
Phpmyadmin Phpmyadmin	Version 3.5.7 rc1

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (24)

http://archives.neohapsis.com/archives/fulldisclosure/2013-04/0101.html

Source: secalert@redhat.com

http://immunityservices.blogspot.com/2019/02/cvss.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103184.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103188.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103195.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2013-06/msg00181.html

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2013/04/09/13

Source: secalert@redhat.com

http://packetstormsecurity.com/files/121205/phpMyAdmin-3.5.7-Cross-Site-Scripting.html

Source: secalert@redhat.com

Exploit

http://www.mandriva.com/security/advisories?name=MDVSA-2013:144

Source: secalert@redhat.com

http://www.phpmyadmin.net/home_page/security/PMASA-2013-1.php

Source: secalert@redhat.com

http://www.waraxe.us/advisory-102.html

Source: secalert@redhat.com

Exploit

https://github.com/phpmyadmin/phpmyadmin/commit/79089c9bc02c82c15419fd9d6496b8781ae08a5a

Source: secalert@redhat.com

http://archives.neohapsis.com/archives/fulldisclosure/2013-04/0101.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://immunityservices.blogspot.com/2019/02/cvss.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103184.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103188.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103195.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2013-06/msg00181.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://openwall.com/lists/oss-security/2013/04/09/13

Source: af854a3a-2127-422b-91ae-364da2661108

http://packetstormsecurity.com/files/121205/phpMyAdmin-3.5.7-Cross-Site-Scripting.html

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.mandriva.com/security/advisories?name=MDVSA-2013:144

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.phpmyadmin.net/home_page/security/PMASA-2013-1.php

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.waraxe.us/advisory-102.html

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://github.com/phpmyadmin/phpmyadmin/commit/79089c9bc02c82c15419fd9d6496b8781ae08a5a

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.