Detections
Analytics

openSUSE Security Update : phpMyAdmin (openSUSE-2020-1806)

critical Nessus Plugin ID 142572

Language:

Synopsis

The remote openSUSE host is missing a security update.

Description

This update for phpMyAdmin fixes the following issues :

phpMyAdmin was updated to 4.9.7 (boo#1177842) :

 - Fix two factor authentication that was broken in 4.9.6

 - Fix incompatibilities with older PHP versions

Update to 4.9.6 :

 - Fixed XSS relating to the transformation feature (boo#1177561 CVE-2020-26934, PMASA-2020-5)

 - Fixed SQL injection vulnerability in SearchController (boo#1177562 CVE-2020-26935, PMASA-2020-6)

Update to 4.9.5 :

This is a security release containing several bug fixes.

 - CVE-2020-10804: SQL injection vulnerability in the user accounts page, particularly when changing a password (boo#1167335, PMASA-2020-2)

 - CVE-2020-10802: SQL injection vulnerability relating to the search feature (boo#1167336, PMASA-2020-3)

 - CVE-2020-10803: SQL injection and XSS having to do with displaying results (boo#1167337, PMASA-2020-4)

 - Removing of the 'options' field for the external transformation.

Solution

Update the affected phpMyAdmin package.

See Also

https://bugzilla.opensuse.org/show_bug.cgi?id=1167335

https://bugzilla.opensuse.org/show_bug.cgi?id=1167336

https://bugzilla.opensuse.org/show_bug.cgi?id=1167337

https://bugzilla.opensuse.org/show_bug.cgi?id=1177561

https://bugzilla.opensuse.org/show_bug.cgi?id=1177562

https://bugzilla.opensuse.org/show_bug.cgi?id=1177842

Plugin Details

Severity: Critical

ID: 142572

File Name: openSUSE-2020-1806.nasl

Version: 1.4

Type: local

Agent: unix

Published: 11/6/2020

Updated: 2/9/2024

Supported Sensors: Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2020-26935

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:phpmyadmin, cpe:/o:novell:opensuse:15.1

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/1/2020

Vulnerability Publication Date: 3/22/2020

Reference Information

CVE: CVE-2020-10802, CVE-2020-10803, CVE-2020-10804, CVE-2020-26934, CVE-2020-26935