VulnerabilityModified

CVE-2013-5029

phpMyAdmin 3.5.x and 4.0.x before 4.0.5 allows remote attackers to bypass the clickjacking protection mechanism via certain vectors related to Header.class.php.

MEDIUM 4.3EPSS 2.28%

Does this matter?

Lower severity and a low EPSS score (2.28%). Track it; it rarely justifies an emergency change on its own.

Description

phpMyAdmin 3.5.x and 4.0.x before 4.0.5 allows remote attackers to bypass the clickjacking protection mechanism via certain vectors related to Header.class.php.

CVSS 2.0: 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS: 2.28% probability · 82th percentile
CISA KEV: Not listed
Weakness: CWE-20
Affected: opensuse/opensuse · phpmyadmin/phpmyadmin
Source: cve@mitre.org

References

http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00013.html
http://secunia.com/advisories/54488Vendor Advisory
http://www.phpmyadmin.net/home_page/security/PMASA-2013-10.phpVendor Advisory
https://github.com/phpmyadmin/phpmyadmin/commit/240b8332db53dedc27baeec5306dabad3bdece3bExploit, Patch
https://github.com/phpmyadmin/phpmyadmin/commit/24d0eb55203b029f250c77d63f2900ffbe099e8bExploit, Patch
https://github.com/phpmyadmin/phpmyadmin/commit/66fe475d4f51b1761719cb0cab360748800373f7Patch
https://github.com/phpmyadmin/phpmyadmin/commit/da4042fb6c4365dc8187765c3bf525043687c66fExploit, Patch
http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00013.html
http://secunia.com/advisories/54488Vendor Advisory
http://www.phpmyadmin.net/home_page/security/PMASA-2013-10.phpVendor Advisory
https://github.com/phpmyadmin/phpmyadmin/commit/240b8332db53dedc27baeec5306dabad3bdece3bExploit, Patch
https://github.com/phpmyadmin/phpmyadmin/commit/24d0eb55203b029f250c77d63f2900ffbe099e8bExploit, Patch
https://github.com/phpmyadmin/phpmyadmin/commit/66fe475d4f51b1761719cb0cab360748800373f7Patch
https://github.com/phpmyadmin/phpmyadmin/commit/da4042fb6c4365dc8187765c3bf525043687c66fExploit, Patch

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.