CVE-2020-10803: debian debian_linux Cross-site Scripting
Vulnerability summary
CVE-2020-10803 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in debian debian_linux. EPSS estimates a 1.37% chance of exploitation in the next 30 days, higher than 71.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 7 · Related 5Timeline
- 22-03-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tbl_get_field.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger the XSS attack.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
1.37%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
0.00 pp
From 1.37% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Affected systems
Debian2 products
- phpmyadmin< 4:4.9.5+dfsg1-1
- debian_linuxEOL8.0
Opensuse2 products
- backports_sle15.0 | 15.0:sp1
- leapEOL15.1
Fedoraproject1 product
- fedoraEOL30 | 31 | 32
Phpmyadmin1 product
- phpmyadmin≥ 4.0.0, < 4.9.5 | ≥ 5.0.0, < 5.0.2
Suse1 product
Ubuntu1 product
- phpmyadminAll versions (No fix recorded) | < 4:4.6.6-5ubuntu0.5
6 vendors · 8 products
References
14 links
lists.debian.org/debian-lts-announce/2020/03/msg00028.htmlMailing ListX Refsource MLISTREPORTThird Party Advisory- lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.htmlVendor AdvisoryX Refsource SUSEBroken LinkMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.htmlVendor AdvisoryX Refsource SUSEBroken LinkMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.htmlVendor AdvisoryX Refsource SUSEBroken LinkMailing ListThird Party Advisory