CVE-2018-19968: Infoleak
An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this phpMyAdmin vulnerability?
The vulnerability ID for this phpMyAdmin vulnerability is CVE-2018-19968.
What is the severity of CVE-2018-19968?
The severity of CVE-2018-19968 is medium.
How can an attacker exploit CVE-2018-19968?
An attacker can exploit CVE-2018-19968 by using the transformation feature in phpMyAdmin before version 4.8.4 to leak the contents of a local file.
What software versions are affected by CVE-2018-19968?
The phpMyAdmin versions before 4.8.4 are affected by CVE-2018-19968.
Are there any references available for CVE-2018-19968?
Yes, you can find references for CVE-2018-19968 at the following links: http://www.securityfocus.com/bid/106178, https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html, and https://security.gentoo.org/glsa/201904-16.