Description

phpMyAdmin before 2.11.5.1 stores the MySQL (1) username and (2) password, and the (3) Blowfish secret key, in cleartext in a Session file under /tmp, which allows local users to obtain sensitive information.

Remediation

References

CVE-2008-1567

Related Vulnerabilities

Liferay Portal Improper Authentication Vulnerability (CVE-2021-29047)

Joomla CVE-2006-4469 Vulnerability (CVE-2006-4469)

Zenphoto Improper Privilege Management Vulnerability (CVE-2018-0610)

phpMyFAQ Improper Restriction of Excessive Authentication Attempts Vulnerability (CVE-2017-11187)

GibbonEdu Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2023-45880)

Severity

Medium

Classification

CVE-2008-1567 CWE-312 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities