CVE-2020-11441

phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. NOTE: the vendor states "I don't see anything specifically exploitable.

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

2.41% chance of exploitation in the next 30 days, 83th percentile

Nuclei

medium · CWE-93

Published

2020-03-31

Updated

2024-08-04

Proof-of-concept exploits (1)

• phpmyadmin/phpmyadmin/issues/16056

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11441.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2020-11439
• CVE-2020-11444
• CVE-2020-11438
• CVE-2020-11449
• CVE-2020-11437
• CVE-2020-11450