CVE-2009-1148: Path Traversal
Published Mar 26, 2009
·Updated
Directory traversal vulnerability in bsdispasmimetype.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to read arbitrary files via directory traversal sequences in the filepath parameter ($filename variable).
Affected Software
8 affected components
phpMyAdmin phpMyAdmin<=3.1.3
phpMyAdmin phpMyAdmin=3.1.0
phpMyAdmin phpMyAdmin=3.1.0.0
phpMyAdmin phpMyAdmin=3.1.1
phpMyAdmin phpMyAdmin=3.1.1-rc1
phpMyAdmin phpMyAdmin=3.1.2
phpMyAdmin phpMyAdmin=3.1.2-rc1
phpMyAdmin phpMyAdmin=3.1.3-rc1
Remediation
Event History
Mar 26, 2009
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·02:30 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2009-1148?
CVE-2009-1148 is considered a moderate severity vulnerability due to its potential for unauthorized file access.
2
How do I fix CVE-2009-1148?
To fix CVE-2009-1148, upgrade phpMyAdmin to version 3.1.3.1 or later, which addresses this vulnerability.
3
Which versions of phpMyAdmin are affected by CVE-2009-1148?
CVE-2009-1148 affects phpMyAdmin versions 3.1.0 to 3.1.3 inclusive.
4
What type of attack does CVE-2009-1148 facilitate?
CVE-2009-1148 facilitates directory traversal attacks, allowing attackers to read arbitrary files on the server.
5
What components are involved in CVE-2009-1148?
CVE-2009-1148 involves the bs_disp_as_mime_type.php file in the BLOB streaming feature of phpMyAdmin.