CVE - CVE-2011-2719

CVE-ID
CVE-2011-2719	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
libraries/auth/swekey/swekey.auth.lib.php in phpMyAdmin 3.x before 3.3.10.3 and 3.4.x before 3.4.3.2 does not properly manage sessions associated with Swekey authentication, which allows remote attackers to modify the SESSION superglobal array, other superglobal arrays, and certain swekey.auth.lib.php local variables via a crafted query string, a related issue to CVE-2011-2505.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:20110724 phpMyAdmin 3.x Conditional Session Manipulation URL:http://seclists.org/fulldisclosure/2011/Jul/300 MISC:20110724 phpMyAdmin 3.x Conditional Session Manipulation URL:http://www.securityfocus.com/archive/1/518967/100/0/threaded MISC:20110804 Re: [Full-disclosure] phpMyAdmin 3.x Conditional Session Manipulation URL:http://www.securityfocus.com/archive/1/519155/100/0/threaded MISC:45315 URL:http://secunia.com/advisories/45315 MISC:45365 URL:http://secunia.com/advisories/45365 MISC:45515 URL:http://secunia.com/advisories/45515 MISC:48874 URL:http://www.securityfocus.com/bid/48874 MISC:74112 URL:~~http://osvdb.org/74112~~ (Obsolete source) MISC:8322 URL:http://securityreason.com/securityalert/8322 MISC:DSA-2286 URL:http://www.debian.org/security/2011/dsa-2286 MISC:FEDORA-2011-9725 URL:http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html MISC:FEDORA-2011-9734 URL:http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html MISC:MDVSA-2011:124 URL:~~http://www.mandriva.com/security/advisories?name=MDVSA-2011:124~~ (Obsolete source) MISC:[oss-security] 20110725 CVE-Request -- phpMyAdmin -- PMASA-2011-11 and PMASA-2011-12 URL:http://www.openwall.com/lists/oss-security/2011/07/25/4 MISC:[oss-security] 20110726 Re: CVE-Request -- phpMyAdmin -- PMASA-2011-11 and PMASA-2011-12 URL:http://www.openwall.com/lists/oss-security/2011/07/26/10 MISC:http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=571cdc6ff4bf375871b594f4e06f8ad3159d1754 URL:http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=571cdc6ff4bf375871b594f4e06f8ad3159d1754 MISC:http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=e7bb42c002885c2aca7aba4d431b8c63ae4de9b7 URL:http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=e7bb42c002885c2aca7aba4d431b8c63ae4de9b7 MISC:http://www.phpmyadmin.net/home_page/security/PMASA-2011-12.php URL:http://www.phpmyadmin.net/home_page/security/PMASA-2011-12.php MISC:http://www.xxor.se/advisories/phpMyAdmin_3.x_Conditional_Session_Manipulation.txt URL:http://www.xxor.se/advisories/phpMyAdmin_3.x_Conditional_Session_Manipulation.txt MISC:https://bugzilla.redhat.com/show_bug.cgi?id=725384 URL:https://bugzilla.redhat.com/show_bug.cgi?id=725384 MISC:phpmyadmin-swekey-file-overwrite(68769) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/68769
Assigning CNA
Red Hat, Inc.
Date Record Created
20110711	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20110711)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)

Use of the CVE® List and the associated references from this website are subject to the terms of use. CVE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Copyright © 1999–2024, The MITRE Corporation. CVE and the CVE logo are registered trademarks of The MITRE Corporation.