Protection Mechanism Failure in phpMyAdmin - CVE-2017-18264
Published: November 23, 2019
Vulnerability identifier: #VU22940
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-18264
CWE-ID: CWE-693
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to unexpected behavior of the subst() PHP function that returns false when given '' as the first argument in PHP 5.x. A remote attacker can bypass configured "$cfg['Servers'][$i]['AllowNoPassword'] = false" setting and login under account that has not password set.
Affected software
phpMyAdmin
Ubuntu
phpmyadmin (Ubuntu package)
Ubuntu
phpmyadmin (Ubuntu package)
How to mitigate CVE-2017-18264
Install updates from vendor's website.
phpMyAdmin - addressed in versions 4.0.10.20, 4.7.0
phpmyadmin (Ubuntu package) - addressed in versions 4:4.0.10-1ubuntu0.1+esm4, 4:4.5.4.1-2ubuntu2.1+esm6, 4:4.6.6-5ubuntu0.5+esm1, 4:4.9.5+dfsg1-2ubuntu0.1~esm1
phpmyadmin (Ubuntu package) - addressed in versions 4:4.0.10-1ubuntu0.1+esm4, 4:4.5.4.1-2ubuntu2.1+esm6, 4:4.6.6-5ubuntu0.5+esm1, 4:4.9.5+dfsg1-2ubuntu0.1~esm1