CVE-2020-10804
Fixed in a distro release EPSS 2%
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in libraries/classes/Server/Privileges.php and libraries/classes/UserPassword.php). A malicious user with access to the server could create a crafted username, and then trick the victim into performing specific actions with that user account (such as editing its privileges).
Products: phpmyadmin, fedoraproject fedora, opensuse backports_sle, opensuse leap, suse package_hub
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | phpmyadmin/phpmyadmin | 4.9.5 |
| Packagist | phpmyadmin/phpmyadmin | 5.0.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | phpmyadmin | 4:4.9.5+dfsg1-1 |
| Debian 13 | phpmyadmin | 4:4.9.5+dfsg1-1 |
| Debian 14 | phpmyadmin | 4:4.9.5+dfsg1-1 |
| SUSE Package Hub 12 | phpMyAdmin | 4.9.7-bp151.3.24.1 |
| SUSE Package Hub 12 | phpMyAdmin | 4.9.5-43.1 |
| SUSE Package Hub 15 | phpMyAdmin | 4.9.7-bp151.3.24.1 |
| SUSE Package Hub 15 SP1 | phpMyAdmin | 4.9.7-bp151.3.24.1 |
| SUSE Package Hub 15 SP1 | phpMyAdmin | 4.9.5-bp151.3.15.1 |
| Ubuntu 18.04 LTS | phpmyadmin | 4:4.6.6-5ubuntu0.5 |
| Ubuntu Pro 14.04 LTS | phpmyadmin | no fix |
| Ubuntu Pro 16.04 LTS | phpmyadmin | no fix |
| openSUSE Leap 15.1 | phpMyAdmin | 4.9.5-43.1 |
| openSUSE Leap 15.1 | phpMyAdmin | 4.9.7-bp151.3.24.1 |
| openSUSE Tumbleweed | phpMyAdmin | 5.1.1-1.2 |