Home > Vulnerability Database > CVE-2011-2505

Mend.io Vulnerability Database

CVE-2011-2505

Date: July 14, 2011

libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 assigns values to arbitrary parameters referenced in the query string, which allows remote attackers to modify the SESSION superglobal array via a crafted request, related to a "remote variable manipulation vulnerability."

Language: PHP

Severity Score

6.5

Related Resources (23)

Url: http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/

Url: http://www.phpmyadmin.net/home_page/security/PMASA-2011-5.php

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2011-2505

Url: http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html

Url: http://www.osvdb.org/73611

Url: http://secunia.com/advisories/45292

Url: http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=7ebd958b2bf59f96fecd5b3322bdbd0b244a7967

Url: https://security-tracker.debian.org/tracker/CVE-2011-2505

Url: http://www.openwall.com/lists/oss-security/2011/06/29/11

Url: http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt

Url: http://www.exploit-db.com/exploits/17514/

Url: http://securityreason.com/securityalert/8306

Url: http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html

Url: http://www.openwall.com/lists/oss-security/2011/06/28/8

Url: http://www.mandriva.com/security/advisories?name=MDVSA-2011:124

Url: http://www.openwall.com/lists/oss-security/2011/06/28/6

Url: http://www.securityfocus.com/archive/1/518804/100/0/threaded

Url: http://secunia.com/advisories/45139

Url: http://www.debian.org/security/2011/dsa-2286

Url: http://secunia.com/advisories/45315

Url: https://nvd.nist.gov/vuln/detail/CVE-2011-2505

Url: http://www.openwall.com/lists/oss-security/2011/06/28/2

Url: https://www.mend.io/vulnerability-database/CVE-2011-2505

Severity Score

6.5

Weakness Type (CWE)

Code Injection

CWE-94

CVSS v3.1

Base Score:	6.5
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	LOW
Availability (A):	LOW

CVSS v2

Base Score:	6.4
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2011-2505

Date: July 14, 2011

Language: PHP

Severity Score

Related Resources (23)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?