Fluid Attacks Database

Description

Exposure of Sensitive Information to an Unauthorized Actor in PhpMyAdmin PhpMyAdmin before 5.1.3 allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 11	phpmyadmin	=4:5.0.4+dfsg2-2 \|\| =4:5.0.4+dfsg2-2+deb11u1 \|\| =4:5.0.4+dfsg2-2+deb11u2 \|\| =4:5.1.1+dfsg1-1 \|\| =4:5.1.1+dfsg1-2 \|\| =4:5.1.1+dfsg1-3 \|\| =4:5.1.1+dfsg1-4 \|\| =4:5.1.1+dfsg1-4~bpo11+1 \|\| =4:5.1.1+dfsg1-5 \|\| =4:5.1.3+dfsg1-1 \|\| =4:5.1.4+dfsg1-1 \|\| =4:5.1.4+dfsg1-1~bpo11+1 \|\| =4:5.1.4+dfsg1-2 \|\| =4:5.1.4+dfsg1-2~bpo11+1 \|\| =4:5.1.4+dfsg1-3 \|\| =4:5.2.0+dfsg1-1 \|\| =4:5.2.0+dfsg1-2 \|\| =4:5.2.1+dfsg-1 \|\| =4:5.2.1+dfsg-1~bpo11+1 \|\| =4:5.2.1+dfsg-2 \|\| =4:5.2.1+dfsg-3 \|\| =4:5.2.1+dfsg-4 \|\| =4:5.2.2-dev+759fe912a-1 \|\| =4:5.2.2-really+dfsg-1 \|\| =4:5.2.2-really+dfsg-2 \|\| =4:5.2.2-really5.2.2+20241130+dfsg-1 \|\| =4:5.2.2-really5.2.2+20241228+dfsg-1 \|\| =4:5.2.2-really5.2.2+20250114+dfsg-1 \|\| =4:5.2.2-really5.2.2+20250121+dfsg-1 \|\| =4:5.2.3+dfsg-1 \|\| =4:5.2.4~dev~git20260809.e0909b211b+dfsg-1	-
debian 13	phpmyadmin	>=0 <4:5.1.3+dfsg1-1	4:5.1.3+dfsg1-1
packagist	phpmyadmin/phpmyadmin	>=0 <5.1.3	5.1.3
debian 12	phpmyadmin	>=0 <4:5.1.3+dfsg1-1	4:5.1.3+dfsg1-1
debian 14	phpmyadmin	>=0 <4:5.1.3+dfsg1-1	4:5.1.3+dfsg1-1

Aliases

1. CVE-2022-08132. NVD-2022-08133. OSV-DEBIAN-2022-08134. OSV-2022-08135. GCVE-2022-08136. SECURITY-TRACKER-CVE-2022-08137. security.gentoo.org

References

1. https://www.phpmyadmin.net/news/2022/2/11/phpmyadmin-4910-and-513-are-released

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.