An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer feature. References: https://www.phpmyadmin.net/security/PMASA-2018-3/
Created phpMyAdmin tracking bugs for this issue: Affects: epel-all [bug 1594417] Affects: fedora-all [bug 1594416]
Laura, can you see if this really affects phpMyAdmin 4.0.10.20 and 4.4.15.10 as shipped by EPEL 6 and 7?
Hi Robert, The affected code was introduced in this commit: https://github.com/phpmyadmin/phpmyadmin/commit/f4026f60a4b557cbcc61e11f26167a2759ad94af Therefore versions shipped in EPEL are not affected
phpMyAdmin-4.8.2-1.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.