CVE-2020-11441
published 2020-03-31CVE-2020-11441: phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error…
PriorityP335medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
2.31%
81.2th percentile
phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. NOTE: the vendor states "I don't see anything specifically exploitable.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.1MEDIUM
vendor_debian6.1LOW
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-j2jx-6pcj-jfpf: phpMyAdmin 5
ghsa_unreviewed·2022-05-24
CVE-2020-11441 [MEDIUM] GHSA-j2jx-6pcj-jfpf: phpMyAdmin 5
phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page.
OSV
CVE-2020-11441: ** DISPUTED ** phpMyAdmin 5
osv·2020-03-31·CVSS 6.1
CVE-2020-11441 [MEDIUM] CVE-2020-11441: ** DISPUTED ** phpMyAdmin 5
** DISPUTED ** phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. NOTE: the vendor states "I don't see anything specifically exploitable."
OSV
CVE-2020-11441: phpMyAdmin 5
osv·2020-03-31·CVSS 6.1
CVE-2020-11441 [MEDIUM] CVE-2020-11441: phpMyAdmin 5
phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. NOTE: the vendor states "I don't see anything specifically exploitable.
Debian
CVE-2020-11441: phpmyadmin - phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A in...
vendor_debian·2020·CVSS 6.1
CVE-2020-11441 [MEDIUM] CVE-2020-11441: phpmyadmin - phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A in...
phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. NOTE: the vendor states "I don't see anything specifically exploitable.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
No detection rules found.
Nuclei
phpMyAdmin 5.0.2 - CRLF Injection
nuclei·CVSS 6.1
CVE-2020-11441 [MEDIUM] phpMyAdmin 5.0.2 - CRLF Injection
phpMyAdmin 5.0.2 - CRLF Injection
phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. NOTE: the vendor states "I don't see anything specifically exploitable.
Template:
id: CVE-2020-11441
info:
name: phpMyAdmin 5.0.2 - CRLF Injection
author: ritikchaddha
severity: medium
description: |
phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. NOTE: the vendor states "I don't see anything specifically exploitable.
impact: |
Unauthenticated attackers can read arbitrary files from the server including configuration files and credentials, potentially leading to complete system c
2020-03-31
Published