CVE-2022-23807: Improper Authentication in phpMyAdmin
Summary
CVE-2022-23807: Improper Authentication in phpmyadmin. Affects phpmyadmin/phpmyadmin across 2 version ranges.
>= 4.9.0, < 4.9.8
>= 5.1.0, < 5.1.2
Fixed in 4.9.8 or 5.1.2, depending on the release line you run. How to fix ↓
Also tracked for
- phpmyadmin · Bitnami
- phpmyadmin · Debian:11
The same CVE-2022-23807 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks such as creating, modifying, and deleting databases, tables, and records. phpMyAdmin is widely used by developers, system administrators, and database administrators to simplify the management of MySQL databases. However, a vulnerability has been discovered in phpMyAdmin versions 4.9 before 4.9.8 and 5.1 before 5.1.2 that allows a valid user to bypass two-factor authentication for future login instances.
Vulnerability Detail
The vulnerability in phpMyAdmin arises from an improper authentication mechanism. An authenticated user can manipulate their account to bypass the two-factor authentication requirement for subsequent login attempts. This means that even if two-factor authentication is enabled for an account, an attacker with a valid user account can log in without providing the second factor of authentication, compromising the security of the system. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.9.0, < 4.9.84.9.8composer require phpmyadmin/phpmyadmin:4.9.8 -
>= 5.1.0, < 5.1.25.1.2composer require phpmyadmin/phpmyadmin:5.1.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to the patched versions of phpMyAdmin as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in phpMyAdmin allows a valid user to bypass two-factor authentication, compromising the security of the system. To mitigate this vulnerability, it is crucial to upgrade to phpMyAdmin version 4.9.8 or later (if using version 4.9) or version 5.1.2 or later (if using version 5.1). For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source tool for managing MySQL databases. It provides a web-based interface for performing various database management tasks.
The vulnerability allows a valid user to bypass two-factor authentication, compromising the security of the system.
Versions 4.9 before 4.9.8 and 5.1 before 5.1.2 are affected by this vulnerability.
To fix this vulnerability, upgrade to phpMyAdmin version 4.9.8 or later (if using version 4.9) or version 5.1.2 or later (if using version 5.1).
No, there is no specific workaround available. Upgrading to the patched versions is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
