PT-2019-3742 · Phpmyadmin+4 · Phpmyadmin+4

Manuel García Cárdenas · Published 2019-05-18 · Updated 2024-06-15 · CVE-2019-12922

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions phpMyAdmin version 4.9.0.1

Description The issue is related to a CSRF problem that can be exploited by a remote attacker to delete any server on the Setup page. This allows for unauthorized actions on the database management system.

Recommendations For phpMyAdmin version 4.9.0.1, consider restricting access to the Setup page as a temporary workaround until a patch is available. Additionally, ensure that all users of the system are aware of the potential for unauthorized server deletion to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

ALT-PU-2019-3177

ALT-PU-2020-3212

ALT-PU-2021-3657

BDU:2019-04000

CVE-2019-12922

GHSA-4C9Q-64GQ-XHX4

OPENSUSE-SU-2019:2211-1

OPENSUSE-SU-2019_2211-1

OPENSUSE-SU-2020:0056-1

OPENSUSE-SU-2024:11171-1

USN-4843-1

Affected Products

Alt Linux

Linuxmint

Suse

Ubuntu

Phpmyadmin

References · 85

• 🔥 http://seclists.org/fulldisclosure/2019/Sep/23 · Exploit
• 🔥 http://packetstormsecurity.com/files/154483/phpMyAdmin-4.9.0.1-Cross-Site-Request-Forgery.html · Exploit
• 🔥 https://exploit-db.com/exploits/47385 · Exploit
• https://github.com/phpmyadmin/phpmyadmin/commit/7d21d4223bdbe0306593309132b4263d7087d13b · Patch
• https://github.com/phpmyadmin/phpmyadmin/commit/427fbed55d3154d96ecfc1c7784d49eaa3c04161 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2019:2211-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-12922 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/QJ5BW2VEMD2P23ZYRWHDBEQHOKGKGWD6 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-12581 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PBLBE6CSC2ZLINIRBUU5XBLXYVBTF3KA · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YCB3PTGHZ7AJCM6BKCQRRP6HG3OKYCMN · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QJ5BW2VEMD2P23ZYRWHDBEQHOKGKGWD6 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19617 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-1000015 · Vendor Advisory