Vulnerability DatabaseCVE-2011-2508
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2011-2508
July 14, 2011
Directory traversal vulnerability in libraries/display_tbl.lib.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1, when a certain MIME transformation feature is enabled, allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in a GLOBALS[mime_map][$meta->name][transformation] parameter.
Related Resources (28)
http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=b434320eff8ca9c2fc1b043c1804f868341af9a7
http://www.mandriva.com/security/advisories?name=MDVSA-2011:124
https://web.archive.org/web/20111217070727/http://www.securityfocus.com/archive/1/518804/100/0/threaded
https://nvd.nist.gov/vuln/detail/CVE-2011-2508
http://www.phpmyadmin.net/home_page/security/PMASA-2011-8.php
http://securityreason.com/securityalert/8306
http://www.openwall.com/lists/oss-security/2011/06/29/11
https://people.canonical.com/~ubuntu-security/cve/CVE-2011-2508
http://secunia.com/advisories/45292
http://www.debian.org/security/2011/dsa-2286
http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/
http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html
http://secunia.com/advisories/45139
https://web.archive.org/web/20111109175131/http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008
http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=b434320eff8ca9c2fc1b043c1804f868341af9a7
https://web.archive.org/web/20110712103138/http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt
https://github.com/phpmyadmin/phpmyadmin
http://www.osvdb.org/73614
https://web.archive.org/web/20250218012437/http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html
http://www.securityfocus.com/archive/1/518804/100/0/threaded
https://security-tracker.debian.org/tracker/CVE-2011-2508
http://www.openwall.com/lists/oss-security/2011/06/28/6
http://www.openwall.com/lists/oss-security/2011/06/28/2
http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html
https://web.archive.org/web/20111217173735/http://securityreason.com/securityalert/8306
http://www.openwall.com/lists/oss-security/2011/06/28/8
http://secunia.com/advisories/45315
http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt
Do you need more information?
Contact Us
CVSS v4
Base Score:
2.3
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
LOW
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
Exploit Maturity
POC
CVSS v3
Base Score:
5
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW
CVSS v2
Base Score:
6
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
Weakness Type (CWE)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22
EPSS
Base Score:
11.17