libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha.

Versions of phpMyAdmin 4.3.x prior to 4.3.13.2 or 4.4.x prior to 4.4.14.1 are unpatched for by a security bypass vulnerability related to reCaptcha processing. An unauthenticated, remote attacker can exploit this to bypass the reCaptcha test, resulting in a bypass of brute-force protection.

Several issues have been fixed in phpMyAdmin, the web administration tool for MySQL.

  - CVE-2014-8958 (Wheezy only)     Multiple cross-site scripting (XSS) vulnerabilities.

  - CVE-2014-9218 (Wheezy only)     Denial of service (resource consumption) via a long     password.

  - CVE-2015-2206     Risk of BREACH attack due to reflected parameter.

  - CVE-2015-3902     XSRF/CSRF vulnerability in phpMyAdmin setup.

  - CVE-2015-3903 (Jessie only)     Vulnerability allowing man-in-the-middle attack on API     call to GitHub.

  - CVE-2015-6830 (Jessie only)     Vulnerability that allows bypassing the reCaptcha test.

  - CVE-2015-7873 (Jessie only)     Content spoofing vulnerability when redirecting user to     an external site.

phpMyAdmin was updated to the latest supported upstream release 4.4.14. Besides all upstream bug fixes and improvements, it fixes the following vulnerability :

  - CVE-2015-6830: reCaptcha bypass boo#945420

phpMyAdmin 4.4.14.1 (2015-09-08) ================================ - [security] reCaptcha bypass

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.3.x prior to 4.3.13.2 or 4.4.x prior to 4.4.14.1. It is, therefore, affected by a security bypass vulnerability related to reCaptcha processing. An unauthenticated, remote attacker can exploit this to bypass the reCaptcha test, resulting in a bypass of brute-force protection.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The phpMyAdmin development team reports :

This vulnerability allows to complete the reCaptcha test and subsequently perform a brute-force attack to guess user credentials without having to complete further reCaptcha tests.

We consider this vulnerability to be non critical since reCaptcha is an additional opt-in security measure.

ID	Name	Product	Family	Severity
9105	phpMyAdmin 4.3.x < 4.3.13.2 / 4.4.x < 4.4.14.1 reCaptcha Bypass (PMASA-2015-4)	Nessus Network Monitor	CGI	medium
86665	Debian DSA-3382-1 : phpmyadmin - security update	Nessus	Debian Local Security Checks	medium
86280	openSUSE Security Update : phpMyAdmin (openSUSE-2015-629)	Nessus	SuSE Local Security Checks	medium
86041	Fedora 23 : phpMyAdmin-4.4.14.1-1.fc23 (2015-15384)	Nessus	Fedora Local Security Checks	medium
85986	phpMyAdmin 4.3.x < 4.3.13.2 / 4.4.x < 4.4.14.1 reCaptcha Bypass (PMASA-2015-4)	Nessus	CGI abuses	medium
85923	Fedora 21 : phpMyAdmin-4.4.14.1-1.fc21 (2015-15386)	Nessus	Fedora Local Security Checks	medium
85922	Fedora 22 : phpMyAdmin-4.4.14.1-1.fc22 (2015-15385)	Nessus	Fedora Local Security Checks	medium
85858	FreeBSD : phpMyAdmin -- reCaptcha bypass (3904f759-5659-11e5-a207-6805ca0b3d42)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2015-6830

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium