CVE-2022-23807 Improper Authentication in phpmyadmin
Authenticated users can bypass two-factor authentication for future logins by manipulating their account settings in phpMyAdmin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23807?
CVE-2022-23807 is a medium-severity authentication bypass vulnerability in Phpmyadmin Phpmyadmin, published on 22 Jan 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.
Weakness: CWE-287
Which versions are affected by CVE-2022-23807?
5 open source packages ship an affected version, including phpmyadmin/phpmyadmin and phpmyadmin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
phpmyadmin/phpmyadmin Packagist | From 4.9.0 | 4.9.8 |
phpmyadmin/phpmyadmin Packagist | From 4.9.0 | 4.9.8 |
phpmyadmin/phpmyadmin Packagist | From 5.1.0 | 5.1.2 |
phpmyadmin/phpmyadmin Packagist | From 5.1.0 | 5.1.2 |
phpmyadmin Bitnami | From 4.9.0 | 4.9.8, 5.1.2 |
Products include Phpmyadmin Phpmyadmin.
How do I fix CVE-2022-23807?
Upgrade phpmyadmin/phpmyadmin to a fixed version for your release line: 4.9.8 or 5.1.2.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-23807 being exploited?
There is no known exploitation of CVE-2022-23807 in the wild and no public exploit code.
Other vulnerabilities in Phpmyadmin Phpmyadmin
Sources
Also known as BIT-phpmyadmin-2022-23807, DEBIAN-CVE-2022-23807, GHSA-8wf2-3ggj-78q9, UBUNTU-CVE-2022-23807.