PT-2018-15177 · Phpmyadmin+4 · Phpmyadmin+4

Daniel Le Gall · Published 2018-12-11 · Updated 2024-06-15 · CVE-2018-19968

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions prior to 4.8.4

Description The issue allows an attacker to leak the contents of a local file due to an error in the transformation feature. To exploit this, the attacker must have access to the phpMyAdmin Configuration Storage tables, which can be created in any database the attacker has access to. The attacker must also have valid credentials to log in to phpMyAdmin, as this issue does not bypass the login system.

Recommendations For versions prior to 4.8.4, update to version 4.8.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the phpMyAdmin Configuration Storage tables to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2019-1296

CVE-2018-19968

DLA-1658-1

GHSA-XC97-R49Q-CXGC

MGASA-2018-0486

OPENSUSE-SU-2018_4124-1

OPENSUSE-SU-2024:11171-1

USN-4639-1

USN-4843-1

Affected Products

Alt Linux

Linuxmint

Suse

Ubuntu

Phpmyadmin

References · 130

• https://ubuntu.com/security/CVE-2014-9218 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4843-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-6619 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-6609 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-19968 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000014 · Security Note
• https://ubuntu.com/security/CVE-2020-26934 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6609 · Security Note
• https://advisories.mageia.org/MGASA-2018-0486.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18264 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9849 · Security Note
• https://ubuntu.com/security/CVE-2019-6799 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-19968 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-10803 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9218 · Security Note