CVE-2022-0813 - PhpMyAdmin exposure of sensitive information

Back Back to CVE browser

HIGH

PhpMyAdmin exposure of sensitive information

Published Mar 9, 2022

7.5

HIGH

CVSS 3.1

EPSS 1.30%

Description

PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.

Affected products

Vendor phpMyAdmin Product phpMyAdmin Default
n/a
- Version
  5.1.1
  Status
  affected
  Constraints
  <=5.1.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

phpMyAdmin

n/a

Version	Status	Constraints
5.1.1	affected	<=5.1.1

Remediation

Vendor solution

This vulnerability has been solved by the phpMyAdmin team in the 5.1.3 version.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1557
Advisory
https://github.com/advisories/GHSA-vx8q-j7h9-vf6q
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-0813
https://security.gentoo.org/glsa/202311-17
vendor-advisory
https://www.incibe-cert.es/en/early-warning/security-advisories/phpmyadmin-exposure-sensitive-information
Third Party Advisory
https://www.phpmyadmin.net/news/2022/2/11/phpmyadmin-4910-and-513-are-released
Release NotesVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1557		Advisory
https://github.com/advisories/GHSA-vx8q-j7h9-vf6q		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-0813
https://security.gentoo.org/glsa/202311-17		vendor-advisory
https://www.incibe-cert.es/en/early-warning/security-advisories/phpmyadmin-exposure-sensitive-information		Third Party Advisory
https://www.phpmyadmin.net/news/2022/2/11/phpmyadmin-4910-and-513-are-released		Release NotesVendor Advisory