CVE-2020-10804
Publication date 22 March 2020
Last updated 24 July 2024
Ubuntu priority
Cvss 3 Severity Score
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in libraries/classes/Server/Privileges.php and libraries/classes/UserPassword.php). A malicious user with access to the server could create a crafted username, and then trick the victim into performing specific actions with that user account (such as editing its privileges).
From the Ubuntu Security Team
It was discovered that phpMyAdmin failed to sanitize certain input. An attacker could use this vulnerability to execute an SQL injection attack via a specially crafted username.
Status
Package | Ubuntu Release | Status |
---|---|---|
phpmyadmin | 24.04 LTS noble |
Not affected
|
22.04 LTS jammy |
Not affected
|
|
20.04 LTS focal |
Not affected
|
|
18.04 LTS bionic |
Fixed 4:4.6.6-5ubuntu0.5
|
|
16.04 LTS xenial |
Vulnerable
|
|
14.04 LTS trusty |
Vulnerable
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 8.0 · High |
Attack vector | Network |
Attack complexity | Low |
Privileges required | Low |
User interaction | Required |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | High |
Availability impact | High |
Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-4639-1
- phpMyAdmin vulnerabilities
- 19 November 2020