CVE-2022-23807: An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their…

PriorityP422medium4.3CVSS 3.1

AVNACLPRLUINSUCNILAN

EPSS

0.74%

50.8th percentile

An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
debian	phpmyadmin	< phpmyadmin 4:5.1.3+dfsg1-1 (bookworm)	phpmyadmin 4:5.1.3+dfsg1-1 (bookworm)
phpmyadmin	phpmyadmin	>= 0 < 4:5.1.3+dfsg1-1	4:5.1.3+dfsg1-1
phpmyadmin	phpmyadmin	>= 0 < 4:5.1.3+dfsg1-1	4:5.1.3+dfsg1-1
phpmyadmin	phpmyadmin	>= 0 < 4:5.1.3+dfsg1-1	4:5.1.3+dfsg1-1
phpmyadmin	phpmyadmin	>= 4.9.0 < 4.9.8	4.9.8
phpmyadmin	phpmyadmin	>= 4.9.0 < 4.9.8	4.9.8
phpmyadmin	phpmyadmin	>= 5.1.0 < 5.1.2	5.1.2
phpmyadmin	phpmyadmin	>= 5.1.0 < 5.1.2	5.1.2

CVSS provenance

nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N

osv4.3MEDIUM

vendor_debian4.3LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.