製品・ソフトウェアに関する情報

JVN脆弱性詳細

phpMyAdmin の libraries/auth/swekey/swekey.auth.lib.php における SESSION スーパーグローバル配列を変更される脆弱性

Title	phpMyAdmin の libraries/auth/swekey/swekey.auth.lib.php における SESSION スーパーグローバル配列を変更される脆弱性
Summary	phpMyAdmin の libraries/auth/swekey/swekey.auth.lib.php は、Swekey 認証に関連したセッションを適切に管理しないため、SESSION スーパーグローバル配列、その他のスーパーグローバル配列、および特定の swekey.auth.lib.php ローカル変数を変更される脆弱性が存在します。本問題は、CVE-2011-2505と関連する可能性があります。
Possible impacts	第三者により、巧妙に細工されたクエリ文字列を介して、SESSION スーパーグローバル配列、その他のスーパーグローバル配列、および特定の swekey.auth.lib.php ローカル変数を変更される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 23, 2011, midnight
Registration Date	March 27, 2012, 6:43 p.m.
Last Update	March 27, 2012, 6:43 p.m.

CVSS2.0 : 警告
Score	6.4
Vector	AV:N/AC:L/Au:N/C:N/I:P/A:P

Affected System

The phpMyAdmin Project

phpMyAdmin 3.3.10.3 未満の 3.x および 3.4.3.2 未満の 3.4.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-2719	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2719
National Vulnerability Database (NVD)
2	CVE-2011-2719	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2719

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
phpMyAdmin
1	PMASA-2011-12	http://www.phpmyadmin.net/home_page/security/PMASA-2011-12.php

Change Log

No	Changed Details	Date of change
0	[2012年03月27日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2011-2719

Summary	libraries/auth/swekey/swekey.auth.lib.php in phpMyAdmin 3.x before 3.3.10.3 and 3.4.x before 3.4.3.2 does not properly manage sessions associated with Swekey authentication, which allows remote attackers to modify the SESSION superglobal array, other superglobal arrays, and certain swekey.auth.lib.php local variables via a crafted query string, a related issue to CVE-2011-2505.
Publication Date	Aug. 2, 2011, 4:55 a.m.
Registration Date	Jan. 28, 2021, 4:39 p.m.
Last Update	Nov. 21, 2024, 10:28 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:beta1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.3.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:alpha::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.4.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:beta1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.1.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.7:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:rc2::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.0.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.6:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.2.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:beta::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:rc1::::::

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.1.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.2.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html
2	http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html
3	http://osvdb.org/74112
4	http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=571cdc6ff4bf375871b594f4e06f8ad3159d1754
5	http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=e7bb42c002885c2aca7aba4d431b8c63ae4de9b7
6	http://seclists.org/fulldisclosure/2011/Jul/300
7	http://secunia.com/advisories/45315
8	http://secunia.com/advisories/45365	Vendor Advisory
9	http://secunia.com/advisories/45515
10	http://securityreason.com/securityalert/8322
11	http://www.debian.org/security/2011/dsa-2286
12	http://www.mandriva.com/security/advisories?name=MDVSA-2011:124
13	http://www.openwall.com/lists/oss-security/2011/07/25/4	Patch
14	http://www.openwall.com/lists/oss-security/2011/07/26/10	Patch
15	http://www.phpmyadmin.net/home_page/security/PMASA-2011-12.php	Patch Vendor Advisory
16	http://www.securityfocus.com/archive/1/518967/100/0/threaded
17	http://www.securityfocus.com/archive/1/519155/100/0/threaded
18	http://www.securityfocus.com/bid/48874
19	http://www.xxor.se/advisories/phpMyAdmin_3.x_Conditional_Session_Manipulation.txt
20	https://bugzilla.redhat.com/show_bug.cgi?id=725384	Patch
21	https://exchange.xforce.ibmcloud.com/vulnerabilities/68769
22	http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html
23	https://exchange.xforce.ibmcloud.com/vulnerabilities/68769
24	https://bugzilla.redhat.com/show_bug.cgi?id=725384	Patch
25	http://www.xxor.se/advisories/phpMyAdmin_3.x_Conditional_Session_Manipulation.txt
26	http://www.securityfocus.com/bid/48874
27	http://www.securityfocus.com/archive/1/519155/100/0/threaded
28	http://www.securityfocus.com/archive/1/518967/100/0/threaded
29	http://www.phpmyadmin.net/home_page/security/PMASA-2011-12.php	Patch Vendor Advisory
30	http://www.openwall.com/lists/oss-security/2011/07/26/10	Patch
31	http://www.openwall.com/lists/oss-security/2011/07/25/4	Patch
32	http://www.mandriva.com/security/advisories?name=MDVSA-2011:124
33	http://www.debian.org/security/2011/dsa-2286
34	http://securityreason.com/securityalert/8322
35	http://secunia.com/advisories/45515
36	http://secunia.com/advisories/45365	Vendor Advisory
37	http://secunia.com/advisories/45315
38	http://seclists.org/fulldisclosure/2011/Jul/300
39	http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=e7bb42c002885c2aca7aba4d431b8c63ae4de9b7
40	http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=571cdc6ff4bf375871b594f4e06f8ad3159d1754
41	http://osvdb.org/74112
42	http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:beta1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.3.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:alpha::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.4.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:beta1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.1.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.7:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:rc2::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.0.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.6:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.2.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.0:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:beta::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:rc1::::::
cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.2:::::::*
cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:rc1::::::