Unscored severity · published Nov 8, 2014
CVE-2014-6300
Cross-site scripting (XSS) vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1 allows remote…
–
CVSS
1.9%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1 allows remote attackers to inject arbitrary web script or HTML, and consequently conduct a cross-site request forgery (CSRF) attack to create a root account, via a crafted URL, related to js/ajax.js.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Opensuse · Opensuse
12.3; 13.1 · source: NVD
PH
Phpmyadmin · Phpmyadmin
4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.2; 4.0.3; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-6300
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-6300
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2014-09/msg00032.html
Patch
http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php
www.securityfocus.com
http://www.securityfocus.com/bid/69790
github.com
https://github.com/phpmyadmin/phpmyadmin/commit/33b39f9f1dd9a4d27856530e5ac004e23b30e8ac
security.gentoo.org
https://security.gentoo.org/glsa/201505-03
More from Opensuse
9.8
CVE-2016-4171
Adobe Flash Player Remote Code Execution Vulnerability
9.8
CVE-2016-4117
Adobe Flash Player Arbitrary Code Execution Vulnerability
9.8
CVE-2016-3427
Oracle Java SE and JRockit Unspecified Vulnerability
9.8
CVE-2015-2590
Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability
9.8
CVE-2015-5119
Adobe Flash Player Use-After-Free Vulnerability