MGASA-2017-0100
Updated phpmyadmin packages fix security vulnerability
A vulnerability was discovered where the restrictions caused by $cfg['Servers'][$i]['AllowNoPassword'] = false are bypassed under certain PHP versions. This can allow the login of users who have no password set even if the administrator has set $cfg['Servers'][$i]['AllowNoPassword'] to false (which is also the default).
What each source reports
OSV No score
Updated phpmyadmin packages fix security vulnerability
A vulnerability was discovered where the restrictions caused by $cfg['Servers'][$i]['AllowNoPassword'] = false are bypassed under certain PHP versions. This can allow the login of users who have no password set even if the administrator has set $cfg['Servers'][$i]['AllowNoPassword'] to false (which is also the default).
- Record
MGASA-2017-0100- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpmyadminMageia:5 |
before 4.4.15.10-2.mga5 | 4.4.15.10-2.mga5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
MGASA-2017-0100 is a vulnerability with no CVSS score yet in phpmyadmin, published April 3, 2017. No source lists public exploit code. Fixed in phpmyadmin 4.4.15.10-2.mga5.