CVE-2018-19968

6.5MEDIUM

Key Information:

Vendor
PHPmyadmin
Status
PHPmyadmin
Vendor
CVE Published:
11 December 2018

Summary

An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.

References

http://www.securityfocus.com/bid/106178
vdb-entryx_refsource_BID
https://www.phpmyadmin.net/security/PMASA-2018-6/
x_refsource_CONFIRM
https://lists.debian.org/debian-lts-announce/2019/02/msg0...
mailing-listx_refsource_MLIST

EPSS Score

14% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.