Lucene search

K
freebsdFreeBSDA5681027-8E03-11E9-85F4-6805CA0B3D42
HistoryJun 04, 2019 - 12:00 a.m.

phpMyAdmin -- CSRF vulnerability in login form

2019-06-0400:00:00
vuxml.freebsd.org
27

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.017 Low

EPSS

Percentile

87.6%

The phpMyAdmin development team reports:

Summary
CSRF vulnerability in login form
Description
A vulnerability was found that allows an attacker to
trigger a CSRF attack against a phpMyAdmin user. The
attacker can trick the user, for instance through a broken
<img> tag pointing at the victim’s
phpMyAdmin database, and the attacker can potentially
deliver a payload (such as a specific INSERT or DELETE
statement) through the victim.
Severity
We consider this vulnerability to be severe.
Mitigation factor Only the ‘cookie’
auth_type is affected; users can temporary use
phpMyAdmin’s http authentication as a workaround.

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.017 Low

EPSS

Percentile

87.6%