Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-Q4MM-89Q2-XFFG
HistoryMay 17, 2022 - 1:52 a.m.

phpMyAdmin vulnerable to XML external entity (XXE) injection attack

2022-05-1701:52:29
CWE-200
CWE-611
GitHub Advisory Database
github.com
8
phpmyadmin
xxe injection
xml import

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

7.1

Confidence

Low

EPSS

0.09

Percentile

94.7%

JSON

The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.

Affected configurations

Vulners
Node
phpmyadminphpmyadminRange3.3.0–3.3.10.5
OR
phpmyadminphpmyadminRange3.4.0–3.4.7.1
VendorProductVersionCPE
phpmyadminphpmyadmin*cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*

References

Related

fedora 3
freebsd 1
exploitpack 1
nessus 8
seebug 2
cve 1
nvd 1
openvas 16
ubuntucve 1
cvelist 1
osv 3
zdt 1
packetstorm 1
phpmyadmin 1
prion 1
exploitdb 1
debiancve 1
debian 1
gentoo 1
fedora
fedora
[SECURITY] Fedora 16 Update: phpMyAdmin-3.4.7.1-1.fc16
2011-11-23 00:55:51
[SECURITY] Fedora 14 Update: phpMyAdmin-3.4.7.1-1.fc14
2011-11-23 01:01:20
[SECURITY] Fedora 15 Update: phpMyAdmin-3.4.7.1-1.fc15
2011-11-23 00:57:54
freebsd
freebsd
phpmyadmin -- Local file inclusion
2011-11-10 00:00:00
exploitpack
exploitpack
phpMyAdmin 3.3.x3.4.x - Local File Inclusion via XML External Entity Injection (Metasploit)
2012-01-14 00:00:00
nessus
nessus
openSUSE Security Update : phpMyAdmin (openSUSE-2011-14)
2014-06-13 00:00:00
FreeBSD : phpmyadmin -- Local file inclusion (1f6ee708-0d22-11e1-b5bd-14dae938ec40)
2011-11-14 00:00:00
Fedora 16 : phpMyAdmin-3.4.7.1-1.fc16 (2011-15841)
2011-11-23 00:00:00
seebug
seebug
phpMyAdmin 3.3.X and 3.4.X - Local File Inclusion via XXE Injection
2012-01-16 00:00:00
phpMyAdmin 3.3.x & 3.4.x - Local File Inclusion via XXE Injection
2014-07-01 00:00:00
cve
cve
CVE-2011-4107
2011-11-17 19:55:01
nvd
nvd
CVE-2011-4107
2011-11-17 19:55:01
openvas
openvas
FreeBSD Ports: phpMyAdmin
2012-02-13 00:00:00
phpMyAdmin XXE Injection Vulnerability (PMASA-2011-17) - Windows
2017-09-11 00:00:00
Fedora Update for phpMyAdmin FEDORA-2011-15831
2011-11-25 00:00:00
ubuntucve
ubuntucve
CVE-2011-4107
2011-11-17 00:00:00
cvelist
cvelist
CVE-2011-4107
2011-11-17 19:00:00
osv
osv
phpMyAdmin vulnerable to XML external entity (XXE) injection attack
2022-05-17 01:52:29
phpmyadmin - several
2012-01-22 00:00:00
phpMyAdmin-4.6.5.2-1.1 on GA media
2024-06-15 00:00:00
zdt
zdt
phpMyAdmin 3.3.X and 3.4.X - Local File Inclusion via XXE Injection
2012-01-14 00:00:00
packetstorm
packetstorm
phpMyAdmin 3.3.x / 3.4.x Local File Inclusion Via XXE Injection
2012-01-16 00:00:00
phpmyadmin
phpmyadmin
Local file inclusion.
2011-11-10 00:00:00
prion
prion
Xxe
2011-11-17 19:55:00
exploitdb
exploitdb
phpMyAdmin 3.3.x/3.4.x - Local File Inclusion via XML External Entity Injection (Metasploit)
2012-01-14 00:00:00
debiancve
debiancve
CVE-2011-4107
2011-11-17 19:55:01
debian
debian
[SECURITY] [DSA 2391-1] phpmyadmin security update
2012-01-22 13:00:02
gentoo
gentoo
phpMyAdmin: Multiple vulnerabilities
2012-01-04 00:00:00

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

7.1

Confidence

Low

EPSS

0.09

Percentile

94.7%

JSON
Related for GHSA-Q4MM-89Q2-XFFG
fedora3freebsd1exploitpack1nessus8seebug2cve1nvd1openvas16ubuntucve1cvelist1osv3zdt1packetstorm1phpmyadmin1prion1exploitdb1debiancve1debian1gentoo1