Vulnerability Details : CVE-2011-2718
Multiple directory traversal vulnerabilities in the relational schema implementation in phpMyAdmin 3.4.x before 3.4.3.2 allow remote authenticated users to include and execute arbitrary local files via directory traversal sequences in an export type field, related to (1) libraries/schema/User_Schema.class.php and (2) schema_export.php.
Vulnerability category: Directory traversal
Exploit prediction scoring system (EPSS) score for CVE-2011-2718
Probability of exploitation activity in the next 30 days: 0.90%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 81 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2011-2718
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
6.0
|
MEDIUM | AV:N/AC:M/Au:S/C:P/I:P/A:P |
6.8
|
6.4
|
NIST |
CWE ids for CVE-2011-2718
-
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.Assigned by: nvd@nist.gov (Primary)
References for CVE-2011-2718
-
http://www.securityfocus.com/bid/48874
phpMyAdmin Prior to 3.3.10.3 and 3.4.3.2 Multiple Remote Vulnerabilities
-
https://bugzilla.redhat.com/show_bug.cgi?id=725383
725383 – (CVE-2011-2718, PMASA-2011-11) CVE-2011-2718 phpMyAdmin: v3.3.10.3, v3.4.3.2: Local file inclusion and code execution in 'relational schema' code (PMASA-2011-11)Patch
-
http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html
[SECURITY] Fedora 15 Update: phpMyAdmin-3.4.3.2-1.fc15
-
http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html
[SECURITY] Fedora 14 Update: phpMyAdmin-3.4.3.2-1.fc14
-
http://www.phpmyadmin.net/home_page/security/PMASA-2011-11.php
phpMyAdmin - Security - PMASA-2011-11Patch;Vendor Advisory
-
http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=3ae58f0cd6b89ad4767920f9b214c38d3f6d4393
phpMyAdmin / None tools
-
http://www.openwall.com/lists/oss-security/2011/07/26/10
oss-security - Re: CVE-Request -- phpMyAdmin -- PMASA-2011-11 and PMASA-2011-12Patch
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/68768
phpMyAdmin schema file include CVE-2011-2718 Vulnerability Report
-
http://www.mandriva.com/security/advisories?name=MDVSA-2011:124
mandriva.com
-
http://www.openwall.com/lists/oss-security/2011/07/25/4
oss-security - CVE-Request -- phpMyAdmin -- PMASA-2011-11 and PMASA-2011-12Patch
Products affected by CVE-2011-2718
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.1:*:*:*:*:*:*:*