Ubuntu.comUB:CVE-2011-2507CVE-2011-2507
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.166 Low
EPSS
Percentile
96.0%
libraries/server_synchronize.lib.php in the Synchronize implementation in
phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly
quote regular expressions, which allows remote authenticated users to
inject a PCRE e (aka PREG_REPLACE_EVAL) modifier, and consequently execute
arbitrary PHP code, by leveraging the ability to modify the SESSION
superglobal array.
Bugs
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 11.10 | noarch | phpmyadmin | < 4:3.4.3.1-1 | UNKNOWN |
| ubuntu | 12.04 | noarch | phpmyadmin | < 4:3.4.3.1-1 | UNKNOWN |
| ubuntu | 12.10 | noarch | phpmyadmin | < 4:3.4.3.1-1 | UNKNOWN |
| ubuntu | 13.04 | noarch | phpmyadmin | < 4:3.4.3.1-1 | UNKNOWN |
| ubuntu | 13.10 | noarch | phpmyadmin | < 4:3.4.3.1-1 | UNKNOWN |
Related
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.166 Low
EPSS
Percentile
96.0%