libraries/Config.class.php in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 disables X.509 certificate verification for GitHub API calls over SSL, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

According to its self-reported version, the phpMyAdmin application hosted on the remote web server is 4.0.x prior to 4.0.10.10, 4.2.x prior to 4.2.13.3, 4.3.x prior to 4.3.13.1, or 4.4.x prior to 4.4.6.1. It is, therefore, affected by multiple vulnerabilities.

  - Multiple cross-site request forgery (XSRF) vulnerabilities in the setup process in phpMyAdmin 4.0.x before     4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 allow remote attackers     to hijack the authentication of administrators for requests that modify the configuration file.
    (CVE-2015-3902)

  - libraries/Config.class.php in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before     4.3.13.1, and 4.4.x before 4.4.6.1 disables X.509 certificate verification for GitHub API calls over SSL,     which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted     certificate. (CVE-2015-3903)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Versions of phpMyAdmin 4.0.x prior to 4.0.10.10, 4.2.x prior to 4.2.13.3, 4.3.x prior to 4.3.13.1, or 4.4.x prior to 4.4.6.1 are unpatched for the following vulnerabilities : 

 - An attacker could trick a user with a crafted URL during installation to alter the configuration file being generated. (CVE-2015-3902)
 - A flaw exists in 'libraries/Config.class.php' due to an error in an API call to GitHub that allows a man-in-the-middle attacker to perform unauthorized actions. (CVE-2015-3903) 

Several issues have been fixed in phpMyAdmin, the web administration tool for MySQL.

  - CVE-2014-8958 (Wheezy only)     Multiple cross-site scripting (XSS) vulnerabilities.

  - CVE-2014-9218 (Wheezy only)     Denial of service (resource consumption) via a long     password.

  - CVE-2015-2206     Risk of BREACH attack due to reflected parameter.

  - CVE-2015-3902     XSRF/CSRF vulnerability in phpMyAdmin setup.

  - CVE-2015-3903 (Jessie only)     Vulnerability allowing man-in-the-middle attack on API     call to GitHub.

  - CVE-2015-6830 (Jessie only)     Vulnerability that allows bypassing the reCaptcha test.

  - CVE-2015-7873 (Jessie only)     Content spoofing vulnerability when redirecting user to     an external site.

phpMyAdmin was updated to 4.2.13.3 to fix three security issues.

The following vulnerabilities were fixed :

  - CVE-2015-3902: CSRF vulnerability in setup     (PMASA-2015-2, boo#930992)

  - CVE-2015-3903: Vulnerability allowing man-in-the-middle     attack (PMASA-2015-3, boo#930993)

  - CVE-2015-2206: Risk of BREACH attack (PMASA-2015-1,     boo#920773)

Also contains all upstream bug fixes in the 4.2.13 branch.

phpMyAdmin 4.4.6.1 (2015-05-13) ===============================

  - [security] CSRF vulnerability in setup

    - [security] Vulnerability allowing man-in-the-middle       attack

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The phpMyAdmin development team reports :

XSRF/CSRF vulnerability in phpMyAdmin setup.

By deceiving a user to click on a crafted URL, it is possible to alter the configuration file being generated with phpMyAdmin setup.

This vulnerability only affects the configuration file generation process and does not affect the effective configuration file.
Moreover, the configuration file being generated is at risk only during the period when it's writable.

Vulnerability allowing man-in-the-middle attack on API call to GitHub.

A vulnerability in the API call to GitHub can be exploited to perform a man-in-the-middle attack.

We consider this vulnerability to be serious.

ID	Name	Product	Family	Severity
143273	phpMyAdmin 4.0.x < 4.0.10.10 / 4.2.x < 4.2.13.3 / 4.3.x < 4.3.13.1 / 4.4.x < 4.4.6.1 Multiple Vulnerabilities (PMASA-2015-2, PMASA-2015-3)	Nessus	CGI abuses	medium
9104	phpMyAdmin 4.0.x < 4.0.10.10 / 4.2.x < 4.2.13.3 / 4.3.x < 4.3.13.1 / 4.4.x < 4.4.6.1 Multiple Vulnerabilities (PMASA-2015-2, PMASA-2015-3)	Nessus Network Monitor	CGI	medium
86665	Debian DSA-3382-1 : phpmyadmin - security update	Nessus	Debian Local Security Checks	medium
84533	openSUSE Security Update : phpMyAdmin (openSUSE-2015-466)	Nessus	SuSE Local Security Checks	medium
83827	Fedora 22 : phpMyAdmin-4.4.6.1-1.fc22 (2015-8190)	Nessus	Fedora Local Security Checks	medium
83509	Fedora 20 : phpMyAdmin-4.4.6.1-1.fc20 (2015-8274)	Nessus	Fedora Local Security Checks	medium
83508	Fedora 21 : phpMyAdmin-4.4.6.1-1.fc21 (2015-8267)	Nessus	Fedora Local Security Checks	medium
83441	FreeBSD : phpMyAdmin -- XSRF and man-in-the-middle vulnerabilities (c6e31869-f99f-11e4-9f91-6805ca0b3d42)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2015-3903

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium