Bug 454333 (CVE-2008-3032)

Summary:	CVE-2008-3032 phpmyadmin XSS flaw
Product:	[Other] Security Response	Reporter:	Josh Bressers <bressers>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED DUPLICATE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	mmcgrath, redhat-bugzilla
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3032
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-07-07 19:06:53 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Josh Bressers 2008-07-07 18:51:26 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2008-3032 to the following vulnerability:

Cross-site scripting (XSS) vulnerability in the phpMyAdmin
(phpmyadmin) extension 3.0.1 and earlier for TYPO3 allows remote
attackers to inject arbitrary web script or HTML via unspecified
vectors.

References:

Reference:
CONFIRM:http://typo3.org/teams/security/security-bulletins/typo3-20080701-2/
Reference: BID:30039
Reference: URL:http://www.securityfocus.com/bid/30039
Reference: SECUNIA:30884
Reference: URL:http://secunia.com/advisories/30884
Reference: XF:phpmyadmin-typo3-unspecified-xss(43508)
Reference: URL:http://xforce.iss.net/xforce/xfdb/43508

Comment 1 Robert Scheck 2008-07-07 19:05:17 UTC

Josh, as per phpMyAdmin upstream CVE-2008-3032 is just a duplicate of the
CVE-2008-2960 - but Typo3-based phpMyAdmins. Fedora is not affected.

Comment 2 Robert Scheck 2008-07-07 19:06:53 UTC

If Fedora ships Typo3, it should be re-assigned to Typo3. AFAIK Fedora doesn't 
ship any Typo3 so closing as duplicate hereby.

*** This bug has been marked as a duplicate of 452497 ***

Comment 3 Josh Bressers 2008-07-07 19:50:09 UTC

Bah, I missed that.  Sorry for the bug.