phpMyAdmin Cryptographic Vulnerability
Moderate severity
GitHub Reviewed
Published
May 17, 2022
to the GitHub Advisory Database
•
Updated Jul 31, 2023
Package
Affected versions
>= 4.6, < 4.6.5
>= 4.4, < 4.4.15.9
>= 4.0, < 4.0.10.18
Patched versions
4.6.5
4.4.15.9
4.0.10.18
Description
Published by the National Vulnerability Database
Dec 11, 2016
Published to the GitHub Advisory Database
May 17, 2022
Last updated
Jul 31, 2023
Reviewed
Jul 31, 2023
An issue was discovered in phpMyAdmin. When the user does not specify a blowfish_secret key for encrypting cookies, phpMyAdmin generates one at runtime. A vulnerability was reported where the way this value is created uses a weak algorithm. This could allow an attacker to determine the user's blowfish_secret and potentially decrypt their cookies. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References