PT-2018-15177 · Phpmyadmin+4 · Phpmyadmin+4

Daniel Le Gall · Publicado 2018-12-11 · Atualizado 2024-06-15 · CVE-2018-19968

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions prior to 4.8.4

Description The issue allows an attacker to leak the contents of a local file due to an error in the transformation feature. To exploit this, the attacker must have access to the phpMyAdmin Configuration Storage tables, which can be created in any database the attacker has access to. The attacker must also have valid credentials to log in to phpMyAdmin, as this issue does not bypass the login system.

Recommendations For versions prior to 4.8.4, update to version 4.8.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the phpMyAdmin Configuration Storage tables to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

ALT-PU-2019-1296

CVE-2018-19968

DLA-1658-1

GHSA-XC97-R49Q-CXGC

MGASA-2018-0486

OPENSUSE-SU-2018_4124-1

OPENSUSE-SU-2024:11171-1

USN-4639-1

USN-4843-1

Produtos afetados

Alt Linux

Linuxmint

Suse

Ubuntu

Phpmyadmin

Referências · 130

• https://github.com/phpmyadmin/phpmyadmin/commit/d2886a3 · Nota
• https://github.com/phpmyadmin/phpmyadmin/commit/62b2c918d26cc78d1763945e3d44d1a63294a819 · Nota
• https://github.com/phpmyadmin/phpmyadmin/commit/1ac863c7573d12012374d5d41e5c7dc5505ea6e1 · Nota
• https://github.com/phpmyadmin/phpmyadmin/commit/095729d81205f15f40d216d25917017da4c2fff8 · Nota
• https://github.com/phpmyadmin/phpmyadmin/commit/6a1ba61e29002f0305a9322a8af4eaaeb11c0732 · Nota
• https://github.com/phpmyadmin/composer · Nota
• https://ubuntu.com/security/CVE-2014-9218 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-4843-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-6619 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-6609 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-19968 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-19968.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000014 · Nota de Segurança
• https://suse.com/security/cve/CVE-2017-1000499 · Nota
• https://ubuntu.com/security/CVE-2020-26934 · Aviso do Fabricante