CVE-2013-4729: phpMyAdmin Global variables scope injection vulnerability
import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request.
Other sources
phpMyAdmin Global variables scope injection vulnerability
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/phpmyadmin/phpmyadminto a version that resolves this vulnerability.Fixed in 4.0.4.1 - Upgrade
Upgrade
phpMyAdminto a version that resolves this vulnerability.Fixed in 4.0.4.1
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4729?
CVE-2013-4729 has a medium severity level due to its potential for unauthorized configuration changes.
How do I fix CVE-2013-4729?
To fix CVE-2013-4729, upgrade phpMyAdmin to version 4.0.4.1 or later.
Who is affected by CVE-2013-4729?
Users of phpMyAdmin versions 4.0.0 through 4.0.4 are affected by CVE-2013-4729.
What is the impact of CVE-2013-4729 on phpMyAdmin?
CVE-2013-4729 allows remote authenticated users to manipulate the GLOBALS superglobal array and change configurations.
Is CVE-2013-4729 exploitable remotely?
Yes, CVE-2013-4729 can be exploited remotely by authenticated users.