CVE-2022-23807: phpMyAdmin Account Manipulation Bypass
Summary
CVE-2022-23807: An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. Affects phpmyadmin across 2 version ranges.
>= 4.9.0, < 4.9.8
>= 5.1.0, < 5.1.2
Fixed in 4.9.8 or 5.1.2, depending on the release line you run. How to fix ↓
Also tracked for
- phpmyadmin/phpmyadmin · Packagist
- phpmyadmin · Debian:11
The same CVE-2022-23807 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks, such as creating tables, executing queries, and managing user accounts. This vulnerability affects phpMyAdmin versions 4.9 before 4.9.8 and 5.1 before 5.1.2. It allows a valid user who is already authenticated to phpMyAdmin to manipulate their account and bypass two-factor authentication for future login instances.
Vulnerability Detail
The vulnerability in phpMyAdmin allows an authenticated user to bypass two-factor authentication. By manipulating their account settings, the user can disable or circumvent the two-factor authentication requirement, which is designed to provide an additional layer of security. This can lead to unauthorized access to the user's account and potentially compromise the confidentiality and integrity of the database. The vulnerability is rated as medium severity with a CVSSv3 score of 5.3.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.9.0, < 4.9.84.9.8 -
>= 5.1.0, < 5.1.25.1.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patch or upgrade to the fixed versions as soon as possible.
Conclusion
The phpMyAdmin account manipulation bypass vulnerability allows an authenticated user to bypass two-factor authentication, potentially compromising the security of the user's account and the associated database. It is crucial to upgrade to the fixed versions or apply the official patch to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin →
FAQ
phpMyAdmin is an open-source tool for managing MySQL databases. It provides a web-based interface for performing various database management tasks.
Versions 4.9 before 4.9.8 and 5.1 before 5.1.2 of phpMyAdmin are affected by this vulnerability.
This vulnerability allows an authenticated user to bypass two-factor authentication, potentially leading to unauthorized access to the user's account and compromise of the database.
To fix this vulnerability, upgrade your phpMyAdmin installation to version 4.9.8 or later for versions 4.9.x, and version 5.1.2 or later for versions 5.1.x.
There is no known workaround for this vulnerability. It is recommended to apply the official patch or upgrade to the fixed versions.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
