crítica
CVE-2017-18264
An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 ...
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA. Más baja según Ubuntu (media).
Descripción
An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases. The restrictions caused by $cfg['Servers'][$i]['AllowNoPassword'] = false are bypassed under certain PHP versions (e.g., version 5). This can allow the login of users who have no password set even if the administrator has set $cfg['Servers'][$i]['AllowNoPassword'] to false (which is also the default). This occurs because some implementations of the PHP substr function return false when given '' as the first argument.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| composer::GitHub Security Advisory Composer | phpmyadmin/phpmyadmin | 4.0.10.20, 4.7.0 |
| debian 11 | phpmyadmin | 4:4.6.6-2 |
| debian 12 | phpmyadmin | 4:4.6.6-2 |
| debian 13 | phpmyadmin | 4:4.6.6-2 |
| debian 14 | phpmyadmin | 4:4.6.6-2 |
| debian 8 | phpmyadmin | 4:4.2.12-2+deb8u3 |
| echo | phpmyadmin | 4:4.6.6-2 |
| ubuntu 14.04-ESM | phpmyadmin | 4:4.0.10-1ubuntu0.1+esm4 |
| ubuntu 16.04-ESM | phpmyadmin | 4:4.5.4.1-2ubuntu2.1+esm3 |
Referencias
- http://www.securityfocus.com/bid/97211
- https://github.com/phpmyadmin/composer
- https://github.com/phpmyadmin/phpmyadmin/commit/7232271a379396ca1d4b083af051262057003c41%20%284.7-branch%29
- https://github.com/phpmyadmin/phpmyadmin/commit/b6ca92cc75c8a16001425be7881e73430bcc35b8%20%284.0-branch%29
- https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-18264
- https://ubuntu.com/security/notices/USN-4843-1
- https://www.cve.org/CVERecord?id=CVE-2017-18264