PT-2022-24019 · Phpmyfaq · Phpmyfaq

Published 2022-10-29 · Updated 2022-10-31 · CVE-2022-3754

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 3.1.8

Description The issue concerns weak password requirements in the phpMyFAQ repository. Specifically, versions prior to 3.1.8 are affected due to inadequate password length requirements. Version 3.1.8 introduces a minimum password length of eight characters, addressing this issue.

Recommendations For versions prior to 3.1.8, update to version 3.1.8 or later to introduce the eight-character minimum password length requirement and mitigate the risk associated with weak passwords.

Exploit

Fix

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2022-3754

GHSA-2RR3-RV49-P42F

Affected Products

Phpmyfaq

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3754.json · Exploit
• 🔥 https://huntr.dev/bounties/f4711d7f-1368-48ab-9bef-45f32e356c47 · Exploit
• https://github.com/thorsten/phpmyfaq/commit/d7a87d2646287828c70401ca8976ef531fbc77ea · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-3754 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3754 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2rr3-rv49-p42f · Vendor Advisory
• https://github.com/thorsten/phpmyfaq · Note
• https://t.me/cibsecurity/52263 · Telegram Post