Gravedad: Alta
Fecha de publicaci\u00f3n: 14 de enero de 2020 Identificador CVE ids: CVE-2020-5504 Identificar CWE ids: CWE-661
Fuente: phpmyadmin.net
<\/p>\n\n\n\n
Sistemas Afectados<\/strong> I. Descripci\u00f3n<\/strong> II. Soluci\u00f3n<\/strong> III. Referencia a soluciones, herramientas e informaci\u00f3n<\/strong><\/p>\n\n\n\n \u2022 Nueva Inyecci\u00f3n SQL en PhpMyAdmin. CERT-PY. Centro de Respuestas a Incidentes Cibern\u00e9ticos Recopilado en: https:\/\/www.cert.gov.py\/index.php\/noticias\/nueva-inyeccion-sql-en-phpmyadmin<\/a> IV. Informaci\u00f3n de contacto<\/strong> Gravedad: Alta Fecha de publicaci\u00f3n: 14 de enero de 2020 Identificador CVE ids: CVE-2020-5504 Identificar CWE ids: CWE-661 Fuente: phpmyadmin.net Sistemas Afectados Las versiones phpMyAdmin 4.x anteriores a 4.9.4 se ven afectadas, al menos tan…<\/p>\n","protected":false},"author":4,"featured_media":1777,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[4],"tags":[],"class_list":["post-1776","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-avisos-de-seguridad"],"_links":{"self":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/1776","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1776"}],"version-history":[{"count":1,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/1776\/revisions"}],"predecessor-version":[{"id":1778,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/1776\/revisions\/1778"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/media\/1777"}],"wp:attachment":[{"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1776"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1776"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1776"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Las versiones phpMyAdmin 4.x anteriores a 4.9.4 se ven afectadas, al menos tan antiguas como 4.0.0. y las versiones phpMyAdmin 5.x versi\u00f3n 5.0.0 se ve afectada.<\/p>\n\n\n\n
Se ha descubierto una vulnerabilidad cr\u00edtica de inyecci\u00f3n de consultas SQL en PhpMyAdmin, en la p\u00e1gina de cuentas de usuarios lo cual permite a un atacante que tenga una cuenta v\u00e1lida de MySQL, inyectar SQL personalizado al realizar consultas de forma arbitraria.<\/p>\n\n\n\n
\u2022 Aplicar las actualizaciones brindadas para el 4.8 y 4.9 a la versi\u00f3n 4.9.4 o posterior, igualmente para la versi\u00f3n 5.x, actualizar a la versi\u00f3n 5.0.1 o posterior.
\u2022 Aplique el parche a continuaci\u00f3n (https:\/\/gist.github.com\/ibennetch\/4c1b701f4b766e4dd5556e8e26200b6b).
\u2022 Filtrar las conexiones con el motor de base de datos, solo para aquellos equipos que requieran conexi\u00f3n.<\/p>\n\n\n\n
\u2022 Bringing MySQL to the web. PMASA-2020-1. phpMyAdmin team. Recopilado en: https:\/\/www.phpmyadmin.net\/security\/PMASA-2020-1\/<\/a>
\u2022 CVE-2020-5504 Detail. National Vulnerability Database. NIST. Recopilado en: https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2020-5504<\/a><\/p>\n\n\n\n
CSIRT PANAMA
Autoridad Nacional para la Innovaci\u00f3n Gubernamental
E-Mail: info@cert.pa
Web: http:\/\/www.cert.pa<\/p>\n","protected":false},"excerpt":{"rendered":"