Detections
Analytics

Fedora 40 : phpMyAdmin (2025-c17ef0f176)

medium Nessus Plugin ID 214840

Language:

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c17ef0f176 advisory.

 **phpMyAdmin 5.2.2 is released**

 Welcome to the release of phpMyAdmin version 5.2.2, the I should have released this sooner release. This is primarily a bugfix release but also contains a few security fixes as noted below.

 * fix possible security issue in sql-parser which could cause long execution times that could create a DOS attack (thanks to Maximilian Krg)
 * fix an XSS vulnerability in the check tables feature (**PMASA-2025-1**, thanks to bluebird)
 * fix an XSS vulnerability in the Insert tab (**PMASA-2025-2**, thanks to frequent contributor Kamil Tekiela)
 * fix possible security issue with library code slim/psr7 (**CVE-2023-30536**)
 * fix possible security issue relating to iconv (**CVE-2024-2961, PMASA-2025-3**)
 * fix a full path disclosure in the Monitoring tab
 * issue #18268 Fix UI issue the theme manager is disabled
 * issue Allow opening server breadcrumb links in new tab with Ctrl/Meta key
 * issue #19141 Add cookie prefix '-__Secure-' to cookies to help prevent cookie smuggling
 * issue #18106 Fix renaming database with a view
 * issue #18120 Fix bug with numerical tables during renaming database
 * issue #16851 Fix ($cfg['Order']) default column order doesn't have have any effect since phpMyAdmin 4.2.0
 * issue #18258 Speed improvements when exporting a database
 * issue #18769 Improved collations support for MariaDB 10.10

 There are many, many more fixes that you can see in the ChangeLog file included with this release or [online](https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_2/ChangeLog)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected phpMyAdmin package.

See Also

https://bodhi.fedoraproject.org/updates/FEDORA-2025-c17ef0f176

Plugin Details

Severity: Medium

ID: 214840

File Name: fedora_2025-c17ef0f176.nasl

Version: 1.2

Type: local

Agent: unix

Published: 1/31/2025

Updated: 2/3/2025

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.8

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P

CVSS Score Source: CVE-2023-30536

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:fedoraproject:fedora:phpmyadmin, cpe:/o:fedoraproject:fedora:40

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/22/2025

Vulnerability Publication Date: 4/17/2023

Exploitable With

Metasploit (CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961))

Reference Information

CVE: CVE-2023-30536, CVE-2023-44270, CVE-2024-2961, CVE-2024-55565, CVE-2024-56519, CVE-2024-56521, CVE-2024-56522, CVE-2024-56527