phpMyAdmin Unsafe Fetching of Javascript Code
Date: 2022-05
Affected: composer/phpmyadmin/phpmyadmin
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2012-5339
CVE-2012-5368
CWE: CWE-79

phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code.


Mitigations:

Architectural layers (MAESTRO):