CVE-2013-4998: Infoleak
Published Jul 30, 2013
·Updated
phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to pmdcommon.php and other files.
Affected Software
22 affected components
phpMyAdmin phpMyAdmin=3.5.0.0
phpMyAdmin phpMyAdmin=3.5.1.0
phpMyAdmin phpMyAdmin=3.5.2.0
phpMyAdmin phpMyAdmin=3.5.2.1
phpMyAdmin phpMyAdmin=3.5.2.2
phpMyAdmin phpMyAdmin=3.5.3.0
phpMyAdmin phpMyAdmin=3.5.4
phpMyAdmin phpMyAdmin=3.5.5
phpMyAdmin phpMyAdmin=3.5.6
phpMyAdmin phpMyAdmin=3.5.7
phpMyAdmin phpMyAdmin=3.5.7-rc1
phpMyAdmin phpMyAdmin=3.5.8
phpMyAdmin phpMyAdmin=3.5.8-rc1
phpMyAdmin phpMyAdmin=3.5.8.1
phpMyAdmin phpMyAdmin=4.0.0
phpMyAdmin phpMyAdmin=4.0.0-rc2
phpMyAdmin phpMyAdmin=4.0.0-rc3
phpMyAdmin phpMyAdmin=4.0.1
phpMyAdmin phpMyAdmin=4.0.2
phpMyAdmin phpMyAdmin=4.0.3
phpMyAdmin phpMyAdmin=4.0.4
phpMyAdmin phpMyAdmin=4.0.4.1
Event History
Jul 30, 2013
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-4998?
CVE-2013-4998 has a low severity rating as it mainly exposes installation paths through error messages.
2
How do I fix CVE-2013-4998?
To fix CVE-2013-4998, upgrade phpMyAdmin to version 3.5.8.2 or 4.0.4.2 or later.
3
Which versions of phpMyAdmin are affected by CVE-2013-4998?
CVE-2013-4998 affects phpMyAdmin versions 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2.
4
What type of information can be exposed by CVE-2013-4998?
CVE-2013-4998 can expose sensitive information such as the installation path of phpMyAdmin.
5
Is there a workaround for CVE-2013-4998?
The primary recommendation is to update to a patched version, as there are no effective workarounds to fully mitigate the issue.