Analyst readout for executives and security teams
Plain-English summary
CVE-2014-8960 is an authenticated cross-site scripting flaw in phpMyAdmin's error-reporting feature. A logged-in user could cause script or HTML to be injected through a crafted filename. The source bundle does not provide a CVSS score or evidence of active exploitation, but affected phpMyAdmin instances should be upgraded or isolated.
Executive priority
Treat this as a targeted maintenance fix, not an emergency based on the supplied evidence. Prioritize systems where phpMyAdmin is internet-accessible or shared among many administrators.
Technical view
The flaw is in libraries/error_report.lib.php in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12. The vulnerable error-reporting path mishandles a filename value, allowing authenticated remote users to inject web script or HTML.
Likely exposure
Exposure is limited to deployments running affected phpMyAdmin 4.1.x or 4.2.x versions, especially where multiple users can authenticate to phpMyAdmin. The bundle does not identify other affected products beyond phpMyAdmin or downstream distribution packages.
Exploitation context
CISA KEV status is false, and the provided sources do not claim active exploitation. Exploitation requires authentication to phpMyAdmin and interaction with the error-reporting feature using a crafted filename.
Researcher notes
The source record lacks CVSS, CWE, and detailed exploitability context. Analysis should remain bounded to authenticated XSS via crafted filename in phpMyAdmin error reporting and the fixed version ranges named by the CVE description.
Mitigation direction
- Upgrade phpMyAdmin to 4.1.14.7, 4.2.12, or a later fixed release.
- Apply fixed phpMyAdmin packages from the relevant Linux distribution advisory.
- Restrict phpMyAdmin access to trusted administrators and protected networks.
- If upgrade is delayed, check phpMyAdmin or distro guidance for supported temporary controls.
Validation and detection
- Inventory phpMyAdmin versions and flag 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12.
- Confirm whether phpMyAdmin is reachable from untrusted networks.
- Review package manager history for fixed distro advisory updates.
- Check web logs for unusual authenticated use of the error-reporting feature.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2014-8960 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- GLSA-201505-03CVE reference · vendor-advisory, x_refsource_GENTOO
- openSUSE-SU-2014:1561CVE reference · vendor-advisory, x_refsource_SUSE
- https://github.com/phpmyadmin/phpmyadmin/commit/9364e2eee5681681caf7205c0933bc18af11e233CVE reference · x_refsource_CONFIRM
- 71244CVE reference · vdb-entry, x_refsource_BID
- http://www.phpmyadmin.net/home_page/security/PMASA-2014-15.phpCVE reference · x_refsource_CONFIRM
- MDVSA-2014:228CVE reference · vendor-advisory, x_refsource_MANDRIVA
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.