PT-2011-4848
CVE-2011-4107
·
تاريخ النشر
2011-11-17
·
تاريخ التحديث
2024-06-15
الوصف من
CVSS 3.1
6.5
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
phpMyAdmin versions 3.3.x through 3.3.10.4
phpMyAdmin versions 3.4.x through 3.4.7.0
Description
The issue allows remote authenticated users to read arbitrary files via XML data containing external entity references, also known as an XML external entity (XXE) injection attack. This is due to the
simplexml load string function in the XML import plug-in.Recommendations
For phpMyAdmin versions 3.3.x through 3.3.10.4, update to version 3.3.10.5 or later.
For phpMyAdmin versions 3.4.x through 3.4.7.0, update to version 3.4.7.1 or later.
As a temporary workaround, consider disabling the
simplexml load string function in the XML import plug-in until a patch is available. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾