Vulnerability Description
Multiple directory traversal vulnerabilities in the relational schema implementation in phpMyAdmin 3.4.x before 3.4.3.2 allow remote authenticated users to include and execute arbitrary local files via directory traversal sequences in an export type field, related to (1) libraries/schema/User_Schema.class.php and (2) schema_export.php.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Phpmyadmin | Phpmyadmin | 3.4.0.0 |
Related Weaknesses (CWE)
References
- http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.htm
- http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.htm
- http://osvdb.org/74111
- http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba
- http://secunia.com/advisories/45365Vendor Advisory
- http://secunia.com/advisories/45515
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:124
- http://www.openwall.com/lists/oss-security/2011/07/25/4Patch
- http://www.openwall.com/lists/oss-security/2011/07/26/10Patch
- http://www.phpmyadmin.net/home_page/security/PMASA-2011-11.phpPatchVendor Advisory
- http://www.securityfocus.com/bid/48874
- https://bugzilla.redhat.com/show_bug.cgi?id=725383Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/68768
- http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.htm
- http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.htm
FAQ
What is CVE-2011-2718?
CVE-2011-2718 is a vulnerability with a CVSS score of 6.0 (MEDIUM). Multiple directory traversal vulnerabilities in the relational schema implementation in phpMyAdmin 3.4.x before 3.4.3.2 allow remote authenticated users to include and execute arbitrary local files vi...
How severe is CVE-2011-2718?
CVE-2011-2718 has been rated MEDIUM with a CVSS base score of 6.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2011-2718?
Check the references section above for vendor advisories and patch information. Affected products include: Phpmyadmin Phpmyadmin.