{"id":"MGASA-2014-0275","summary":"Updated phpmyadmin packages fix CVE-2014-4349","details":"Updated phpmyadmin packages fix security vulnerability:\n\nIn phpMyAdmin before 4.1.14, it is possible to trigger an XSS when hiding\nor unhiding a crafted table name in the navigation, due to unescaped HTML\noutput in the navigation items hiding feature. Note that this vulnerability\ncan only be triggered by someone who logged in to phpMyAdmin, as the usual\ntoken protection prevents non-logged-in users from accessing the required\nform (CVE-2014-4349).\n","modified":"2026-04-16T06:25:56.979497884Z","published":"2014-06-27T15:03:09Z","upstream":["CVE-2014-4349"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2014-0275.html"},{"type":"WEB","url":"http://www.phpmyadmin.net/home_page/security/PMASA-2014-3.php"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=13573"}],"affected":[{"package":{"name":"phpmyadmin","ecosystem":"Mageia:3","purl":"pkg:rpm/mageia/phpmyadmin?arch=source&distro=mageia-3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.14.1-1.mga3"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2014-0275.json"}},{"package":{"name":"phpmyadmin","ecosystem":"Mageia:4","purl":"pkg:rpm/mageia/phpmyadmin?arch=source&distro=mageia-4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.14.1-1.mga4"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2014-0275.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}