CVE-2014-4987: Medium severity suse linux vulnerability

Published Jul 20, 2014

Updated

serverusergroups.php in phpMyAdmin 4.1.x before 4.1.14.2 and 4.2.x before 4.2.6 allows remote authenticated users to bypass intended access restrictions and read the MySQL user list via a viewUsers request.

Affected Software

24 affected components

openSUSE openSUSE=12.3

openSUSE openSUSE=13.1

phpMyAdmin phpMyAdmin=4.1.0

phpMyAdmin phpMyAdmin=4.1.1

phpMyAdmin phpMyAdmin=4.1.2

phpMyAdmin phpMyAdmin=4.1.3

phpMyAdmin phpMyAdmin=4.1.4

phpMyAdmin phpMyAdmin=4.1.5

phpMyAdmin phpMyAdmin=4.1.6

phpMyAdmin phpMyAdmin=4.1.7

phpMyAdmin phpMyAdmin=4.1.8

phpMyAdmin phpMyAdmin=4.1.9

phpMyAdmin phpMyAdmin=4.1.10

phpMyAdmin phpMyAdmin=4.1.11

phpMyAdmin phpMyAdmin=4.1.12

phpMyAdmin phpMyAdmin=4.1.13

phpMyAdmin phpMyAdmin=4.1.14

phpMyAdmin phpMyAdmin=4.1.14.1

phpMyAdmin phpMyAdmin=4.2.0

phpMyAdmin phpMyAdmin=4.2.1

phpMyAdmin phpMyAdmin=4.2.2

phpMyAdmin phpMyAdmin=4.2.3

phpMyAdmin phpMyAdmin=4.2.4

phpMyAdmin phpMyAdmin=4.2.5

Event History

Jul 20, 2014

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-4987?

CVE-2014-4987 is classified as a medium severity vulnerability that allows authenticated users to bypass access controls in phpMyAdmin.

How do I fix CVE-2014-4987?

To mitigate CVE-2014-4987, users should upgrade phpMyAdmin to version 4.1.14.2 or later, or 4.2.6 or later.

Which software versions are affected by CVE-2014-4987?

CVE-2014-4987 affects phpMyAdmin versions 4.1.x before 4.1.14.2 and 4.2.x before 4.2.6.

What type of access can be exploited due to CVE-2014-4987?

CVE-2014-4987 allows remote authenticated users to read the MySQL user list by bypassing intended access restrictions.

Is there a specific setting that could be temporarily adjusted to limit exposure for CVE-2014-4987?

While waiting for an update, limiting the scope of user privileges in MySQL can reduce exposure to CVE-2014-4987.