GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

OPENSUSE-SU-2023:0047-1

Vulnerability from csaf_opensuse - Published: 2023-02-15 10:21 - Updated: 2026-09-20 19:45
Summary
Security update for phpMyAdmin
Severity
Important
Notes
Title of the patch: Security update for phpMyAdmin
Description of the patch: This update for phpMyAdmin fixes the following issues: phpMyAdmin was updated to 5.2.1 This is a security and bufix release. * Security: - Fix (PMASA-2023-01, CWE-661, boo#1208186, CVE-2023-25727) Fix an XSS attack through the drag-and-drop upload feature. * Bugfixes: - issue #17522 Fix case where the routes cache file is invalid - issue #17506 Fix error when configuring 2FA without XMLWriter or Imagick - issue Fix blank page when some error occurs - issue #17519 Fix Export pages not working in certain conditions - issue #17496 Fix error in table operation page when partitions are broken - issue #17386 Fix system memory and system swap values on Windows - issue #17517 Fix Database Server panel not getting hidden by ShowServerInfo configuration directive - issue #17271 Fix database names not showing on Processes tab - issue #17424 Fix export limit size calculation - issue #17366 Fix refresh rate popup on Monitor page - issue #17577 Fix monitor charts size on RTL languages - issue #17121 Fix password_hash function incorrectly adding single quotes to password before hashing - issue #17586 Fix statistics not showing for empty databases - issue #17592 Clicking on the New index link on the sidebar does not throw an error anymore - issue #17584 It's now possible to browse a database that includes two % in its name - issue Fix PHP 8.2 deprecated string interpolation syntax - issue Some languages are now correctly detected from the HTTP header - issue #17617 Sorting is correctly remembered when $cfg['RememberSorting'] is true - issue #17593 Table filtering now works when action buttons are on the right side of the row - issue #17388 Find and Replace using regex now makes a valid query if no matching result set found - issue #17551 Enum/Set editor will not fail to open when creating a new column - issue #17659 Fix error when a database group is named tables, views, functions, procedures or events - issue #17673 Allow empty values to be inserted into columns - issue #17620 Fix error handling at phpMyAdmin startup for the JS SQL console - issue Fixed debug queries console broken UI for query time and group count - issue Fixed escaping of SQL query and errors for the debug console - issue Fix console toolbar UI when the bookmark feature is disabled and sql debug is enabled - issue #17543 Fix JS error on saving a new designer page - issue #17546 Fix JS error after using save as and open page operation on the designer - issue Fix PHP warning on GIS visualization when there is only one GIS column - issue #17728 Some select HTML tags will now have the correct UI style - issue #17734 PHP deprecations will only be shown when in a development environment - issue #17369 Fix server error when blowfish_secret is not exactly 32 bytes long - issue #17736 Add utf8mb3 as an alias of utf8 on the charset description page - issue #16418 Fix FAQ 1.44 about manually removing vendor folders - issue #12359 Setup page now sends the Content-Security-Policy headers - issue #17747 The Column Visibility Toggle will not be hidden by other elements - issue #17756 Edit/Copy/Delete row now works when using GROUP BY - issue #17248 Support the UUID data type for MariaDB >= 10.7 - issue #17656 Fix replace/change/set table prefix is not working - issue Fix monitor page filter queries only filtering the first row - issue Fix 'Link not found!' on foreign columns for tables having no char column to show - issue #17390 Fix 'Create view' modal doesn't show on results and empty results - issue #17772 Fix wrong styles for add button from central columns - issue #17389 Fix HTML disappears when exporting settings to browser's storage - issue #17166 Fix 'Warning: #1287 'X' is deprecated [...] Please use ST_X instead.' on search page - issue Use jquery-migrate.min.js (14KB) instead of jquery-migrate.min.js (31KB) - issue #17842 Use jquery.validate.min.js (24 KB) instead of jquery.validate.js (50 KB) - issue #17281 Fix links to databases for information_schema.SCHEMATA - issue #17553 Fix Metro theme unreadable links above navigation tree - issue #17553 Metro theme UI fixes and improvements - issue #17553 Fix Metro theme login form with - issue #16042 Exported gzip file of database has first ~73 kB uncompressed and rest is gzip compressed in Firefox - issue #17705 Fix inline SQL query edit FK checkbox preventing submit buttons from working - issue #17777 Fix Uncaught TypeError: Cannot read properties of null (reading 'inline') on datepickers when re-opened - issue Fix Original theme buttons style and login form width - issue #17892 Fix closing index edit modal and reopening causes it to fire twice - issue #17606 Fix preview SQL modal not working inside 'Add Index' modal - issue Fix PHP error on adding new column on create table form - issue #17482 Default to 'Full texts' when running explain statements - issue Fixed Chrome scrolling performance issue on a textarea of an 'export as text' page - issue #17703 Fix datepicker appears on all fields, not just date - issue Fix space in the tree line when a DB is expanded - issue #17340 Fix 'New Table' page -> 'VIRTUAL' attribute is lost when adding a new column - issue #17446 Fix missing option for STORED virtual column on MySQL and PERSISTENT is not supported on MySQL - issue #17446 Lower the check for virtual columns to MySQL>=5.7.6 nothing is supported on 5.7.5 - issue Fix column names option for CSV Export - issue #17177 Fix preview SQL when reordering columns doesn't work on move columns - issue #15887 Fixed DROP TABLE errors ignored on multi table select for DROP - issue #17944 Fix unable to create a view from tree view button - issue #17927 Fix key navigation between select inputs (drop an old Firefox workaround) - issue #17967 Fix missing icon for collapse all button - issue #18006 Fixed UUID columns can't be moved - issue Add `spellcheck='false'` to all password fields and some text fields to avoid spell-jacking data leaks - issue Remove non working 'Analyze Explain at MariaDB.org' button (MariaDB stopped this service) - issue #17229 Add support for Web Authentication API because Chrome removed support for the U2F API - issue #18019 Fix 'Call to a member function fetchAssoc() on bool' with SQL mode ONLY_FULL_GROUP_BY on monitor search logs - issue Add back UUID and UUID_SHORT to functions on MySQL and all MariaDB versions - issue #17398 Fix clicking on JSON columns triggers update query - issue Fix silent JSON parse error on upload progress - issue #17833 Fix 'Add Parameter' button not working for Add Routine Screen - issue #17365 Fixed 'Uncaught Error: regexp too big' on server status variables page Update to 5.2.0 * Bugfix - issue #16521 Upgrade Bootstrap to version 5 - issue #16521 Drop support for Internet Explorer and others - issue Upgrade to shapefile 3 - issue #16555 Bump minimum PHP version to 7.2 - issue Remove the phpseclib dependency - issue Upgrade Symfony components to version 5.2 - issue Upgrade to Motranslator 4 - issue #16005 Improve the performance of the Export logic - issue #16829 Add NOT LIKE %...% operator to Table search - issue #16845 Fixed some links not passing through url.php - issue #16382 Remove apc upload progress method (all upload progress code was removed from the PHP extension) - issue #16974 Replace zxcvbn by zxcvbn-ts - issue #15691 Disable the last column checkbox in the column list dropdown instead of not allowing un-check - issue #16138 Ignore the length of integer types and show a warning on MySQL >= 8.0.18 - issue Add support for the Mroonga engine - issue Double click column name to directly copy to clipboard - issue #16425 Add DELETE FROM table on table operations page - issue #16482 Add a select all link for table-specific privileges - issue #14276 Add support for account locking - issue #17143 Use composer/ca-bundle to manage the CA cert file - issue #17143 Require the openssl PHP extension - issue #17171 Remove the printview.css file from themes - issue #17203 Redesign the export and the import pages - issue #16197 Replace the master/slave terminology - issue #17257 Replace libraries/vendor_config.php constants with an array - issue Add the Bootstrap theme - issue #17499 Remove stickyfilljs JavaScript dependency Update to 5.1.3 This is a security and bufix release. * Security - Fix for boo#1197036 (CVE-2022-0813) - Fix for path disclosure under certain server configurations (if display_errors is on, for instance) * Bugfix - issue #17308 Fix broken pagination links in the navigation sidebar - issue #17331 Fix MariaDB has no support for system variable 'disabled_storage_engines' - issue #17315 Fix unsupported operand types in Results.php when running 'SHOW PROCESSLIST' SQL query - issue #17288 Fixed importing browser settings question box after login when having no pmadb - issue #17288 Fix 'First day of calendar' user override has no effect - issue #17239 Fixed repeating headers are not working - issue #17298 Fixed import of email-adresses or links from ODS results in empty contents - issue #17344 Fixed a type error on ODS import with non string values - issue #17239 Fixed header row show/hide columns buttons on each line after hover are shown on each row Update to 5.1.2 This is a security and bufix release. * Security - Fix boo#1195017 (CVE-2022-23807, PMASA-2022-1, CWE-661) Two factor authentication bypass - Fix boo#1195018 (CVE-2022-23808, PMASA-2022-2, CWE-661) Multiple XSS and HTML injection attacks in setup script * Bugfixes - Revert a changed to $cfg['CharTextareaRows'] allow values less than 7 - Fix encoding of enum and set values on edit value - Fixed possible 'Undefined index: clause_is_unique' error - Fixed some situations where a user is logged out when working with more than one server - Fixed a problem with assigning privileges to a user using the multiselect list when the database name has an underscore - Enable cookie parameter 'SameSite' when the PHP version is 7.3 or newer - Correctly handle the removal of 'innodb_file_format' in MariaDB and MySQL
Patchnames: openSUSE-2023-47
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2022-0813
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Package Hub 15 SP4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch —
Vendor Fix
Unresolved product id: SUSE Package Hub 15 SP4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch —
Vendor Fix
Unresolved product id: SUSE Package Hub 15 SP4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 15.4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 15.4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 15.4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch —
Vendor Fix
Threats
Impact moderate
CVE-2022-23807
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
Recommended 6 products, the same list as for CVE-2022-0813
Threats
Impact moderate
CVE-2022-23808
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Recommended 6 products, the same list as for CVE-2022-0813
Threats
Impact moderate
CVE-2023-25727
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
Recommended 6 products, the same list as for CVE-2022-0813
Threats
Impact moderate
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for phpMyAdmin",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for phpMyAdmin fixes the following issues:\n\nphpMyAdmin was updated to 5.2.1\n\nThis is a security and bufix release.\n\n* Security:\n\n  - Fix (PMASA-2023-01, CWE-661, boo#1208186, CVE-2023-25727) \n    Fix an XSS attack through the drag-and-drop upload feature.\n\n* Bugfixes:\n\n  - issue #17522 Fix case where the routes cache file is invalid\n  - issue #17506 Fix error when configuring 2FA without XMLWriter or Imagick\n  - issue        Fix blank page when some error occurs\n  - issue #17519 Fix Export pages not working in certain conditions\n  - issue #17496 Fix error in table operation page when partitions are broken\n  - issue #17386 Fix system memory and system swap values on Windows\n  - issue #17517 Fix Database Server panel not getting hidden by ShowServerInfo configuration directive\n  - issue #17271 Fix database names not showing on Processes tab\n  - issue #17424 Fix export limit size calculation\n  - issue #17366 Fix refresh rate popup on Monitor page\n  - issue #17577 Fix monitor charts size on RTL languages\n  - issue #17121 Fix password_hash function incorrectly adding single quotes to password before hashing\n  - issue #17586 Fix statistics not showing for empty databases\n  - issue #17592 Clicking on the New index link on the sidebar does not throw an error anymore\n  - issue #17584 It\u0027s now possible to browse a database that includes two % in its name\n  - issue        Fix PHP 8.2 deprecated string interpolation syntax\n  - issue        Some languages are now correctly detected from the HTTP header\n  - issue #17617 Sorting is correctly remembered when $cfg[\u0027RememberSorting\u0027] is true\n  - issue #17593 Table filtering now works when action buttons are on the right side of the row\n  - issue #17388 Find and Replace using regex now makes a valid query if no matching result set found\n  - issue #17551 Enum/Set editor will not fail to open when creating a new column\n  - issue #17659 Fix error when a database group is named tables, views, functions, procedures or events\n  - issue #17673 Allow empty values to be inserted into columns\n  - issue #17620 Fix error handling at phpMyAdmin startup for the JS SQL console\n  - issue        Fixed debug queries console broken UI for query time and group count\n  - issue        Fixed escaping of SQL query and errors for the debug console\n  - issue        Fix console toolbar UI when the bookmark feature is disabled and sql debug is enabled\n  - issue #17543 Fix JS error on saving a new designer page\n  - issue #17546 Fix JS error after using save as and open page operation on the designer\n  - issue        Fix PHP warning on GIS visualization when there is only one GIS column\n  - issue #17728 Some select HTML tags will now have the correct UI style\n  - issue #17734 PHP deprecations will only be shown when in a development environment\n  - issue #17369 Fix server error when blowfish_secret is not exactly 32 bytes long\n  - issue #17736 Add utf8mb3 as an alias of utf8 on the charset description page\n  - issue #16418 Fix FAQ 1.44 about manually removing vendor folders\n  - issue #12359 Setup page now sends the Content-Security-Policy headers\n  - issue #17747 The Column Visibility Toggle will not be hidden by other elements\n  - issue #17756 Edit/Copy/Delete row now works when using GROUP BY\n  - issue #17248 Support the UUID data type for MariaDB \u003e= 10.7\n  - issue #17656 Fix replace/change/set table prefix is not working\n  - issue        Fix monitor page filter queries only filtering the first row\n  - issue        Fix \u0027Link not found!\u0027 on foreign columns for tables having no char column to show\n  - issue #17390 Fix \u0027Create view\u0027 modal doesn\u0027t show on results and empty results\n  - issue #17772 Fix wrong styles for add button from central columns\n  - issue #17389 Fix HTML disappears when exporting settings to browser\u0027s storage\n  - issue #17166 Fix \u0027Warning: #1287 \u0027X\u0027 is deprecated [...] Please use ST_X instead.\u0027 on search page\n  - issue        Use jquery-migrate.min.js (14KB) instead of jquery-migrate.min.js (31KB)\n  - issue #17842 Use jquery.validate.min.js (24 KB) instead of jquery.validate.js (50 KB)\n  - issue #17281 Fix links to databases for information_schema.SCHEMATA\n  - issue #17553 Fix Metro theme unreadable links above navigation tree\n  - issue #17553 Metro theme UI fixes and improvements\n  - issue #17553 Fix Metro theme login form with\n  - issue #16042 Exported gzip file of database has first ~73 kB uncompressed and rest is gzip compressed in Firefox\n  - issue #17705 Fix inline SQL query edit FK checkbox preventing submit buttons from working\n  - issue #17777 Fix Uncaught TypeError: Cannot read properties of null (reading \u0027inline\u0027) on datepickers when re-opened\n  - issue        Fix Original theme buttons style and login form width\n  - issue #17892 Fix closing index edit modal and reopening causes it to fire twice\n  - issue #17606 Fix preview SQL modal not working inside \u0027Add Index\u0027 modal\n  - issue        Fix PHP error on adding new column on create table form\n  - issue #17482 Default to \u0027Full texts\u0027 when running explain statements\n  - issue        Fixed Chrome scrolling performance issue on a textarea of an \u0027export as text\u0027 page\n  - issue #17703 Fix datepicker appears on all fields, not just date\n  - issue        Fix space in the tree line when a DB is expanded\n  - issue #17340 Fix \u0027New Table\u0027 page -\u003e \u0027VIRTUAL\u0027 attribute is lost when adding a new column\n  - issue #17446 Fix missing option for STORED virtual column on MySQL and PERSISTENT is not supported on MySQL\n  - issue #17446 Lower the check for virtual columns to MySQL\u003e=5.7.6 nothing is supported on 5.7.5\n  - issue        Fix column names option for CSV Export\n  - issue #17177 Fix preview SQL when reordering columns doesn\u0027t work on move columns\n  - issue #15887 Fixed DROP TABLE errors ignored on multi table select for DROP\n  - issue #17944 Fix unable to create a view from tree view button\n  - issue #17927 Fix key navigation between select inputs (drop an old Firefox workaround)\n  - issue #17967 Fix missing icon for collapse all button\n  - issue #18006 Fixed UUID columns can\u0027t be moved\n  - issue        Add `spellcheck=\u0027false\u0027` to all password fields and some text fields to avoid spell-jacking data leaks\n  - issue        Remove non working \u0027Analyze Explain at MariaDB.org\u0027 button (MariaDB stopped this service)\n  - issue #17229 Add support for Web Authentication API because Chrome removed support for the U2F API\n  - issue #18019 Fix \u0027Call to a member function fetchAssoc() on bool\u0027 with SQL mode ONLY_FULL_GROUP_BY on monitor search logs\n  - issue        Add back UUID and UUID_SHORT to functions on MySQL and all MariaDB versions\n  - issue #17398 Fix clicking on JSON columns triggers update query\n  - issue        Fix silent JSON parse error on upload progress\n  - issue #17833 Fix \u0027Add Parameter\u0027 button not working for Add Routine Screen\n  - issue #17365 Fixed \u0027Uncaught Error: regexp too big\u0027 on server status variables page\n\nUpdate to 5.2.0\n\n* Bugfix\n\n  - issue #16521 Upgrade Bootstrap to version 5\n  - issue #16521 Drop support for Internet Explorer and others\n  - issue        Upgrade to shapefile 3\n  - issue #16555 Bump minimum PHP version to 7.2\n  - issue        Remove the phpseclib dependency\n  - issue        Upgrade Symfony components to version 5.2\n  - issue        Upgrade to Motranslator 4\n  - issue #16005 Improve the performance of the Export logic\n  - issue #16829 Add NOT LIKE %...% operator to Table search\n  - issue #16845 Fixed some links not passing through url.php\n  - issue #16382 Remove apc upload progress method (all upload progress code was removed from the PHP extension)\n  - issue #16974 Replace zxcvbn by zxcvbn-ts\n  - issue #15691 Disable the last column checkbox in the column list dropdown instead of not allowing un-check\n  - issue #16138 Ignore the length of integer types and show a warning on MySQL \u003e= 8.0.18\n  - issue        Add support for the Mroonga engine\n  - issue        Double click column name to directly copy to clipboard\n  - issue #16425 Add DELETE FROM table on table operations page\n  - issue #16482 Add a select all link for table-specific privileges\n  - issue #14276 Add support for account locking\n  - issue #17143 Use composer/ca-bundle to manage the CA cert file\n  - issue #17143 Require the openssl PHP extension\n  - issue #17171 Remove the printview.css file from themes\n  - issue #17203 Redesign the export and the import pages\n  - issue #16197 Replace the master/slave terminology\n  - issue #17257 Replace libraries/vendor_config.php constants with an array\n  - issue        Add the Bootstrap theme\n  - issue #17499 Remove stickyfilljs JavaScript dependency\n\nUpdate to 5.1.3\n\nThis is a security and bufix release.\n\n* Security\n\n  - Fix for boo#1197036 (CVE-2022-0813)\n  - Fix for path disclosure under certain server configurations\n    (if display_errors is on, for instance)\n\n* Bugfix\n\n  - issue #17308 Fix broken pagination links in the navigation sidebar\n  - issue #17331 Fix MariaDB has no support for system variable \u0027disabled_storage_engines\u0027\n  - issue #17315 Fix unsupported operand types in Results.php when running \u0027SHOW PROCESSLIST\u0027 SQL query\n  - issue #17288 Fixed importing browser settings question box after login when having no pmadb\n  - issue #17288 Fix \u0027First day of calendar\u0027 user override has no effect\n  - issue #17239 Fixed repeating headers are not working\n  - issue #17298 Fixed import of email-adresses or links from ODS results in empty contents\n  - issue #17344 Fixed a type error on ODS import with non string values\n  - issue #17239 Fixed header row show/hide columns buttons on each line after hover are shown on each row\n\nUpdate to 5.1.2\n\nThis is a security and bufix release.\n\n* Security\n\n  - Fix boo#1195017 (CVE-2022-23807, PMASA-2022-1, CWE-661) \n    Two factor authentication bypass\n  - Fix boo#1195018 (CVE-2022-23808, PMASA-2022-2, CWE-661)\n    Multiple XSS and HTML injection attacks in setup script\n\n* Bugfixes\n\n  - Revert a changed to $cfg[\u0027CharTextareaRows\u0027] allow values\n    less than 7\n  - Fix encoding of enum and set values on edit value\n  - Fixed possible \u0027Undefined index: clause_is_unique\u0027 error\n  - Fixed some situations where a user is logged out when working\n    with more than one server\n  - Fixed a problem with assigning privileges to a user using the\n    multiselect list when the database name has an underscore\n  - Enable cookie parameter \u0027SameSite\u0027 when the PHP version\n    is 7.3 or newer\n  - Correctly handle the removal of \u0027innodb_file_format\u0027 in\n    MariaDB and MySQL\n\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2023-47",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2023_0047-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2023:0047-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VQ5VVS2CGDQ32RHYLQQZFFFADPEZO6KM/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2023:0047-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VQ5VVS2CGDQ32RHYLQQZFFFADPEZO6KM/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1195017",
        "url": "https://bugzilla.suse.com/1195017"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1195018",
        "url": "https://bugzilla.suse.com/1195018"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1197036",
        "url": "https://bugzilla.suse.com/1197036"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1208186",
        "url": "https://bugzilla.suse.com/1208186"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-0813 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-0813/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-23807 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-23807/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-23808 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-23808/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-25727 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-25727/"
      }
    ],
    "title": "Security update for phpMyAdmin",
    "tracking": {
      "current_release_date": "2026-09-20T19:45:00Z",
      "generator": {
        "date": "2023-02-15T10:21:02Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2023:0047-1",
      "initial_release_date": "2023-02-15T10:21:02Z",
      "revision_history": [
        {
          "date": "2023-02-15T10:21:02Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T19:45:00Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
                "product": {
                  "name": "phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
                  "product_id": "phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:phpmyadmin:phpmyadmin:5.2.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/phpMyAdmin@5.2.1-bp154.2.3.1?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
                "product": {
                  "name": "phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
                  "product_id": "phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/phpMyAdmin-apache@5.2.1-bp154.2.3.1?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch",
                "product": {
                  "name": "phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch",
                  "product_id": "phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/phpMyAdmin-lang@5.2.1-bp154.2.3.1?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Package Hub 15 SP4",
                "product": {
                  "name": "SUSE Package Hub 15 SP4",
                  "product_id": "SUSE Package Hub 15 SP4"
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.4",
                "product": {
                  "name": "openSUSE Leap 15.4",
                  "product_id": "openSUSE Leap 15.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch as component of SUSE Package Hub 15 SP4",
          "product_id": "SUSE Package Hub 15 SP4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch"
        },
        "product_reference": "phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
        "relates_to_product_reference": "SUSE Package Hub 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch as component of SUSE Package Hub 15 SP4",
          "product_id": "SUSE Package Hub 15 SP4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch"
        },
        "product_reference": "phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
        "relates_to_product_reference": "SUSE Package Hub 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch as component of SUSE Package Hub 15 SP4",
          "product_id": "SUSE Package Hub 15 SP4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch"
        },
        "product_reference": "phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch",
        "relates_to_product_reference": "SUSE Package Hub 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch"
        },
        "product_reference": "phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch"
        },
        "product_reference": "phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch"
        },
        "product_reference": "phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-0813",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-0813"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
          "SUSE Package Hub 15 SP4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
          "SUSE Package Hub 15 SP4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch",
          "openSUSE Leap 15.4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
          "openSUSE Leap 15.4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
          "openSUSE Leap 15.4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-0813",
          "url": "https://www.suse.com/security/cve/CVE-2022-0813"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1197036 for CVE-2022-0813",
          "url": "https://bugzilla.suse.com/1197036"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
            "SUSE Package Hub 15 SP4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
            "SUSE Package Hub 15 SP4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch",
            "openSUSE Leap 15.4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
            "openSUSE Leap 15.4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
            "openSUSE Leap 15.4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
            "SUSE Package Hub 15 SP4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
            "SUSE Package Hub 15 SP4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch",
            "openSUSE Leap 15.4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
            "openSUSE Leap 15.4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
            "openSUSE Leap 15.4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-02-15T10:21:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-0813"
    },
    {
      "cve": "CVE-2022-23807",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-23807"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
          "SUSE Package Hub 15 SP4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
          "SUSE Package Hub 15 SP4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch",
          "openSUSE Leap 15.4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
          "openSUSE Leap 15.4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
          "openSUSE Leap 15.4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-23807",
          "url": "https://www.suse.com/security/cve/CVE-2022-23807"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1195017 for CVE-2022-23807",
          "url": "https://bugzilla.suse.com/1195017"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
            "SUSE Package Hub 15 SP4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
            "SUSE Package Hub 15 SP4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch",
            "openSUSE Leap 15.4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
            "openSUSE Leap 15.4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
            "openSUSE Leap 15.4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
            "SUSE Package Hub 15 SP4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
            "SUSE Package Hub 15 SP4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch",
            "openSUSE Leap 15.4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
            "openSUSE Leap 15.4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
            "openSUSE Leap 15.4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-02-15T10:21:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-23807"
    },
    {
      "cve": "CVE-2022-23808",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-23808"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
          "SUSE Package Hub 15 SP4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
          "SUSE Package Hub 15 SP4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch",
          "openSUSE Leap 15.4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
          "openSUSE Leap 15.4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
          "openSUSE Leap 15.4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-23808",
          "url": "https://www.suse.com/security/cve/CVE-2022-23808"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1195018 for CVE-2022-23808",
          "url": "https://bugzilla.suse.com/1195018"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
            "SUSE Package Hub 15 SP4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
            "SUSE Package Hub 15 SP4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch",
            "openSUSE Leap 15.4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
            "openSUSE Leap 15.4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
            "openSUSE Leap 15.4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
            "SUSE Package Hub 15 SP4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
            "SUSE Package Hub 15 SP4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch",
            "openSUSE Leap 15.4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
            "openSUSE Leap 15.4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
            "openSUSE Leap 15.4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-02-15T10:21:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-23808"
    },
    {
      "cve": "CVE-2023-25727",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-25727"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
          "SUSE Package Hub 15 SP4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
          "SUSE Package Hub 15 SP4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch",
          "openSUSE Leap 15.4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
          "openSUSE Leap 15.4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
          "openSUSE Leap 15.4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-25727",
          "url": "https://www.suse.com/security/cve/CVE-2023-25727"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1208186 for CVE-2023-25727",
          "url": "https://bugzilla.suse.com/1208186"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
            "SUSE Package Hub 15 SP4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
            "SUSE Package Hub 15 SP4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch",
            "openSUSE Leap 15.4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
            "openSUSE Leap 15.4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
            "openSUSE Leap 15.4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
            "SUSE Package Hub 15 SP4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
            "SUSE Package Hub 15 SP4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch",
            "openSUSE Leap 15.4:phpMyAdmin-0:5.2.1-bp154.2.3.1.noarch",
            "openSUSE Leap 15.4:phpMyAdmin-apache-0:5.2.1-bp154.2.3.1.noarch",
            "openSUSE Leap 15.4:phpMyAdmin-lang-0:5.2.1-bp154.2.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-02-15T10:21:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-25727"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.