Detections
Analytics
Alpine: multiple phpmyadmin packages: security update to 5.0.2-r0
high Tenable Cloud Security Plugin ID 406405
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered
where certain parameters are not properly escaped when generating certain queries for search actions in
libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database
or table name. The attack can be performed if a user attempts certain search operations on the malicious
database or table. (CVE-2020-10802)
- In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where
malicious code could be used to trigger an XSS attack through retrieving and displaying results (in
tbl_get_field.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted
data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger
the XSS attack. (CVE-2020-10803)
- In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval
of the current username (in libraries/classes/Server/Privileges.php and
libraries/classes/UserPassword.php). A malicious user with access to the server could create a crafted
username, and then trick the victim into performing specific actions with that user account (such as
editing its privileges). (CVE-2020-10804)
See Also
https://security.alpinelinux.org/vuln/CVE-2020-10802
Plugin Details
Severity: High
ID: 406405
Version: Revision 1.30
Type: Local
Published: 10/31/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.15
CVSS v2
Risk Factor: Medium
Base Score: 6
Temporal Score: 4.4
Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P
CVSS Score Source: CVE-2020-10804
CVSS v3
Risk Factor: High
Base Score: 8
Temporal Score: 7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 3/20/2020