GHSA-567r-vqj7-5cw7

ghsaUSosv

phpMyAdmin Authentication Bypass

view advisory published 2022-05-17Licence: CC-BY-4.0

An issue was discovered in phpMyAdmin involving the `$cfg['ArbitraryServerRegexp']` configuration directive. An attacker could reuse certain cookie values in a way of bypassing the servers defined by ArbitraryServerRegexp. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2016-6629US	critical9.8	3.20% (88th)	—	2016-12-11
An issue was discovered in phpMyAdmin involving the $cfg['ArbitraryServerRegexp'] configuration directive. An attacker could reuse certain cookie values in a way of bypassing the s…

references

External citations — patches, advisories, analysis.

https://nvd.nist.gov/vuln/detail/CVE-2016-6629ADVISORY
https://security.gentoo.org/glsa/201701-32WEB
https://web.archive.org/web/20210725054025/http://www.securityfocus.com/bid/92493WEB
https://www.phpmyadmin.net/security/PMASA-2016-52WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan