PT-2008-3451 · Phpmyadmin · Phpmyadmin

Publicado 2008-04-23 · Atualizado 2017-08-08 · CVE-2008-1924

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions prior to 2.11.5.2

Description The issue allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request. This is related to the use of an undefined UploadDir variable when running on shared hosts.

Recommendations For versions prior to 2.11.5.2, update to version 2.11.5.2 or later to resolve the issue. As a temporary workaround, consider restricting the CREATE table permissions for remote authenticated users until the update is applied.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2008-1924

DSA-1557-1

Produtos afetados

Phpmyadmin

Referências · 20

• https://security-tracker.debian.org/tracker/CVE-2008-1924 · Aviso do Fabricante
• http://secunia.com/advisories/29964 · Aviso do Fabricante
• http://securityfocus.com/bid/28906 · Correção
• http://secunia.com/advisories/33822 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/1328/references · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2008-1924 · Aviso do Fabricante
• http://debian.org/security/2008/dsa-1557 · Aviso do Fabricante
• http://phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3 · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDVSA-2008:131 · Aviso do Fabricante
• http://secunia.com/advisories/29944 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-1924 · Aviso do Fabricante
• http://secunia.com/advisories/30034 · Aviso do Fabricante
• http://secunia.com/advisories/32834 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41964 · Nota