phpMyAdmin release with SQL injection and XSS fixe
Reporter | Title | Published | Views | Family All 72 |
---|---|---|---|---|
![]() | [SECURITY] Fedora 30 Update: phpMyAdmin-4.9.5-1.fc30 | 1 Apr 202002:36 | – | fedora |
![]() | [SECURITY] Fedora 31 Update: phpMyAdmin-5.0.2-1.fc31 | 1 Apr 202001:55 | – | fedora |
![]() | [SECURITY] Fedora 32 Update: phpMyAdmin-5.0.2-2.fc32 | 1 Apr 202016:34 | – | fedora |
![]() | SQL Injection in extension "phpMyAdmin" (phpmyadmin) | 12 May 202000:00 | – | typo3 |
![]() | Updated phpmyadmin packages fix security vulnerability | 1 Apr 202004:56 | – | mageia |
![]() | phpMyAdmin 4.9.0 < 4.9.5 / 5.0.0 < 5.0.2 Multiple Vulnerabilities (PMASA-2020-2, PMASA-2020-3, PMASA-2020-4) | 30 Dec 202000:00 | – | nessus |
![]() | Fedora 30 : phpMyAdmin (2020-25f3aea389) | 2 Apr 202000:00 | – | nessus |
![]() | openSUSE Security Update : phpMyAdmin (openSUSE-2020-405) | 30 Mar 202000:00 | – | nessus |
![]() | Debian DLA-2154-1 : phpmyadmin security update | 23 Mar 202000:00 | – | nessus |
![]() | openSUSE Security Update : phpMyAdmin (openSUSE-2020-1806) | 6 Nov 202000:00 | – | nessus |
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory FEDORA-2020-d7b0a5a84a.
#
include('compat.inc');
if (description)
{
script_id(135107);
script_version("1.3");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/20");
script_cve_id("CVE-2020-10802", "CVE-2020-10803", "CVE-2020-10804");
script_xref(name:"FEDORA", value:"2020-d7b0a5a84a");
script_name(english:"Fedora 31 : phpMyAdmin (2020-d7b0a5a84a)");
script_set_attribute(attribute:"synopsis", value:
"The remote Fedora host is missing a security update.");
script_set_attribute(attribute:"description", value:
"The **phpMyAdmin** team announces the release of both **4.9.5** and
**5.0.2**.
Both versions contain several security fixes :
- PMASA-2020-2 SQL injection vulnerability in the user
accounts page, particularly when changing a password
- PMASA-2020-3 SQL injection vulnerability relating to the
search feature
- PMASA-2020-4 SQL injection and XSS having to do with
displaying results
- Removing of the 'options' field for the external
transformation.
There are many other bugs fixes, please see the ChangeLog file
included with this release for full details.
Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as
possible without introducing additional issues.");
script_set_attribute(attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2020-d7b0a5a84a");
script_set_attribute(attribute:"solution", value:
"Update the affected phpMyAdmin package.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-10804");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"vuln_publication_date", value:"2020/03/22");
script_set_attribute(attribute:"patch_publication_date", value:"2020/04/01");
script_set_attribute(attribute:"plugin_publication_date", value:"2020/04/02");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:phpMyAdmin");
script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:31");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Fedora Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2020-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("rpm.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! preg(pattern:"^31([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 31", "Fedora " + os_ver);
if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
flag = 0;
if (rpm_check(release:"FC31", reference:"phpMyAdmin-5.0.2-1.fc31")) flag++;
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_WARNING,
extra : rpm_report_get()
);
exit(0);
}
else
{
tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, "phpMyAdmin");
}
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo