CVE-2015-6830

EPSS 9.8%

libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha.

Affected products

n/a · n/a

public PoCs found — 1

exploitdbwww.exploit-db.com/exploits/52414unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166294.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166307.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166531.html https://github.com/phpmyadmin/phpmyadmin/commit/785f4e2711848eb8945894199d5870253a88584e https://www.phpmyadmin.net/security/PMASA-2015-4/http://www.debian.org/security/2015/dsa-3382 http://www.securityfocus.com/bid/76674 http://www.securitytracker.com/id/1033546