CVE-2017-1000017: phpMyAdmin SSRF in replication
Summary
CVE-2017-1000017: phpMyAdmin SSRF in replication. Affects phpmyadmin/phpmyadmin across 3 version ranges.
>= 4.0, < 4.0.10.19
>= 4.4, < 4.4.15.10
>= 4.6, < 4.6.6
Fixed in 4.0.10.19, 4.4.15.10 or 4.6.6, depending on the release line you run. How to fix ↓
Also tracked for
- phpmyadmin · Debian:11
The same CVE-2017-1000017 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source administration tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks. This vulnerability affects versions 4.0, 4.4, and 4.6 of phpMyAdmin. The vulnerability allows a user with appropriate permissions to connect to an arbitrary MySQL server, potentially leading to unauthorized access and data leakage.
Vulnerability Detail
The vulnerability in phpMyAdmin arises from a server-side request forgery (SSRF) issue in the replication feature. An attacker who has the necessary permissions can exploit this weakness to establish a connection to a MySQL server of their choice. By leveraging this vulnerability, an attacker can bypass intended restrictions and gain unauthorized access to sensitive data or perform unauthorized actions on the target MySQL server. The impact of this vulnerability is rated as HIGH with a CVSS score of 8.8.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0, < 4.0.10.194.0.10.19composer require phpmyadmin/phpmyadmin:4.0.10.19 -
>= 4.4, < 4.4.15.104.4.15.10composer require phpmyadmin/phpmyadmin:4.4.15.10 -
>= 4.6, < 4.6.64.6.6composer require phpmyadmin/phpmyadmin:4.6.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided patches or upgrade to the fixed versions of phpMyAdmin to address the issue effectively.
Conclusion
The phpMyAdmin SSRF vulnerability in replication can allow an attacker to connect to an arbitrary MySQL server, potentially leading to unauthorized access and data leakage. It is crucial to upgrade to the patched versions of phpMyAdmin or apply the provided patches to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source administration tool for managing MySQL databases. It provides a web-based interface for performing various database management tasks.
Versions 4.0, 4.4, and 4.6 of phpMyAdmin are vulnerable to this SSRF vulnerability.
The vulnerability allows an attacker to connect to an arbitrary MySQL server, potentially leading to unauthorized access and data leakage.
To fix this vulnerability, it is recommended to upgrade to the patched versions of phpMyAdmin: 4.6.6, 4.4.15.10, or 4.0.10.19.
No, there is no known workaround for this vulnerability. Applying the provided patches or upgrading to the fixed versions is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
