GitHub Advisoryadvisory · Packagist

GHSA-q4mm-89q2-xffg phpMyAdmin vulnerable to XML external entity (XXE) injection attack

MEDIUM Published 2022-05-17 Modified 2024-02-09 Official page ↗
Aliases
CVE-2011-4107
Ecosystem
Packagist
Packages
phpmyadmin/phpmyadmin
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-611
Reviewed
2024-02-09

Affected packages

• Packagist phpmyadmin/phpmyadmin: >= 3.4.0, < 3.4.7.1 → fixed in 3.4.7.1 • Packagist phpmyadmin/phpmyadmin: >= 3.3.0, < 3.3.10.5 → fixed in 3.3.10.5

Description

The `simplexml_load_string` function in the XML import plug-in (`libraries/import/xml.php`) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.

Related

Alias · CVE (1)

  • CVE-2011-4107 The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References