CVE-2011-2719
Summary
| CVE | CVE-2011-2719 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2011-08-01 19:55:01 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | libraries/auth/swekey/swekey.auth.lib.php in phpMyAdmin 3.x before 3.3.10.3 and 3.4.x before 3.4.3.2 does not properly manage sessions associated with Swekey authentication, which allows remote attackers to modify the SESSION superglobal array, other superglobal arrays, and certain swekey.auth.lib.php local variables via a crafted query string, a related issue to CVE-2011-2505. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
PartialAV:N/AC:L/Au:N/C:N/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Phpmyadmin | Phpmyadmin | 3.0.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.0.0 | alpha | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.0.0 | beta | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.0.0 | rc1 | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.0.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.0.1 | rc1 | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.0.1.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.0 | beta1 | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.1 | rc1 | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.2 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.2 | rc1 | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.3 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.3 | rc1 | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.3.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.3.2 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.4 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.4 | rc2 | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.5 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.5 | rc1 | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.2.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.2.0 | beta1 | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.2.0 | rc1 | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.2.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.2.1 | rc1 | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.2.2 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.2.2 | rc1 | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.0.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.1.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.10.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.10.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.10.2 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.2.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.3.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.4.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.5.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.5.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.6 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.7 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.8 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.8.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.9.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.9.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.9.2 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.4.0.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.4.1.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.4.2.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.4.3.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.4.3.1 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| oss-security - CVE-Request -- phpMyAdmin -- PMASA-2011-11 and PMASA-2011-12 | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | Patch |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Debian -- Security Information -- DSA-2286-1 phpmyadmin | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Fedora update for phpMyAdmin - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Full Disclosure: phpMyAdmin 3.x Conditional Session Manipulation | af854a3a-2127-422b-91ae-364da2661108 | seclists.org | |
| www.xxor.se/advisories/phpMyAdmin_3.x_Conditional_Session_Manipulation.txt | af854a3a-2127-422b-91ae-364da2661108 | www.xxor.se | |
| Bug 725384 – CVE-2011-2719 phpMyAdmin: v3.3.10.3, v3.4.3.2: Possible session manipulation in Swekey extention authentication (PMASA-2011-12) | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Patch |
| oss-security - Re: CVE-Request -- phpMyAdmin -- PMASA-2011-11 and PMASA-2011-12 | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | Patch |
| phpMyAdmin Multiple Vulnerabilities - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| phpMyAdmin / None tools | af854a3a-2127-422b-91ae-364da2661108 | phpmyadmin.git.sourceforge.net | |
| osvdb.org/74112 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| phpMyAdmin - Security - PMASA-2011-12 | af854a3a-2127-422b-91ae-364da2661108 | www.phpmyadmin.net | Patch, Vendor Advisory |
| phpMyAdmin 3.x Conditional Session Manipulation - CXSecurity.com | af854a3a-2127-422b-91ae-364da2661108 | securityreason.com | |
| [SECURITY] Fedora 15 Update: phpMyAdmin-3.4.3.2-1.fc15 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| [SECURITY] Fedora 14 Update: phpMyAdmin-3.4.3.2-1.fc14 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| Debian update for phpmyadmin - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| phpMyAdmin Prior to 3.3.10.3 and 3.4.3.2 Multiple Remote Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| phpMyAdmin / None tools | af854a3a-2127-422b-91ae-364da2661108 | phpmyadmin.git.sourceforge.net | |
| Security Advisories | Mandriva Linux | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| phpMyAdmin / None tools | MITRE | phpmyadmin.git.sourceforge.net | |
| phpMyAdmin / None tools | MITRE | phpmyadmin.git.sourceforge.net | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.