phpMyAdmin Denial of service (DOS) attack in transformation feature

2022-05-1403:14:46

Google

osv.dev

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.5 Medium

AI Score

Confidence

Low

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

0.002 Low

EPSS

Percentile

60.7%

JSON

An issue was discovered in phpMyAdmin. The transformation feature allows a user to trigger a denial-of-service (DoS) attack against the server. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.

CPENameOperatorVersion
phpmyadmin/phpmyadmineq4.0.6
phpmyadmin/phpmyadmineq4.0.4
phpmyadmin/phpmyadmineq4.0.10.7
phpmyadmin/phpmyadmineq4.0.4.2
phpmyadmin/phpmyadmineq4.0.2
phpmyadmin/phpmyadmineq4.0.7
phpmyadmin/phpmyadmineq4.0.10.5
phpmyadmin/phpmyadmineq4.0.10
phpmyadmin/phpmyadmineq4.0.3
phpmyadmin/phpmyadmineq4.0.10.2

Name	Operator	Version
phpmyadmin/phpmyadmin	eq	4.0.6
phpmyadmin/phpmyadmin	eq	4.0.4
phpmyadmin/phpmyadmin	eq	4.0.10.7
phpmyadmin/phpmyadmin	eq	4.0.4.2
phpmyadmin/phpmyadmin	eq	4.0.2
phpmyadmin/phpmyadmin	eq	4.0.7
phpmyadmin/phpmyadmin	eq	4.0.10.5
phpmyadmin/phpmyadmin	eq	4.0.10
phpmyadmin/phpmyadmin	eq	4.0.3
phpmyadmin/phpmyadmin	eq	4.0.10.2