{"id":"CVE-2018-12581","published":"2018-06-21T20:00:00Z","modified":"2024-08-05T08:38:06Z","title":"An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer feature.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01781,"percentile":0.7818,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.securityfocus.com/bid/104530","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.securitytracker.com/id/1041187","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2018-3/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":15.6,"factors":[{"name":"EPSS percentile","points":15.64}]},"affected":[{"ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","vulnerableRanges":["<4.8.2"],"patched":["4.8.2"],"from":["GHSA-vxj6-pm6r-23hq"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5456","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-phpmyadmin-phpmyadmin-cve-2018-12581","children":[{"from":"CVE-2018-12581","to":"CVE-2019-11768","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["js/designer/move.js"],"commits":["https://github.com/phpmyadmin/phpmyadmin/commit/6943fff87324bd54c3a37a5160a5fb77498c355e","https://github.com/phpmyadmin/phpmyadmin/commit/c1ecafc38319e8f768c9259d4d580e42acd5ee86"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.71,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2017-1000499","published":"2018-01-03","fixed":"4.7.7","kev":false},{"cve":"CVE-2018-7260","published":"2018-02-21","fixed":"4.7.8","kev":false},{"cve":"CVE-2018-10188","published":"2018-04-19","fixed":"4.8.0.1","kev":false,"link":{"from":"CVE-2018-10188","to":"CVE-2018-12581","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:phpmyadmin/phpmyadmin","fromFixed":"4.8.0.1","toFixed":"4.8.2","daysApart":63}]}},{"cve":"CVE-2018-12581","published":"2018-06-21","fixed":"4.8.2","kev":false},{"cve":"CVE-2018-12613","published":"2018-06-21","fixed":"4.8.2","kev":false},{"cve":"CVE-2018-15605","published":"2018-08-24","fixed":"4.8.3","kev":false},{"cve":"CVE-2018-19968","published":"2018-12-11","fixed":"4.8.4","kev":false}],"package":"Packagist:phpmyadmin/phpmyadmin"}}