CVE-2020-37116: GUnet OpenEclass 1.7.3 E-learning platform - phpMyAdmin Remote Access
GUnet OpenEclass 1.7.3 includes phpMyAdmin 2.10.0.2 by default, which allows remote logins. Attackers with access to the platform can remotely access phpMyAdmin and, after uploading a shell, view the config.php file to obtain the MySQL password, leading to full database compromise.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GUnet OpenEclassto a version that resolves this vulnerability.Fixed in 1.7.3 - Compensating control
Restrict network access to phpMyAdmin so it is not reachable remotely from untrusted networks (only allow access from trusted IPs or internal management networks).
Event History
Frequently Asked Questions
What is the severity of CVE-2020-37116?
CVE-2020-37116 has been rated as critical due to the potential for remote attacks on vulnerable installations.
How do I fix CVE-2020-37116?
To fix CVE-2020-37116, immediately update GUnet OpenEclass to a version that no longer includes the vulnerable phpMyAdmin version.
What software is affected by CVE-2020-37116?
CVE-2020-37116 affects GUnet OpenEclass 1.7.3 due to its inclusion of the vulnerable phpMyAdmin 2.10.0.2.
What vulnerabilities can be exploited through CVE-2020-37116?
CVE-2020-37116 can be exploited to perform remote logins to phpMyAdmin, allowing attackers to upload malicious scripts.
Is CVE-2020-37116 easy to exploit?
Yes, CVE-2020-37116 is considered easy to exploit for attackers who already have access to the GUnet OpenEclass platform.