CVE-2018-19968: Infoleak
First published: Tue Dec 11 2018(Updated: )
An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| phpMyAdmin phpMyAdmin | >=4.0.0<4.8.4 | |
| Debian Debian Linux | =8.0 | |
| composer/phpmyadmin/phpmyadmin | <4.8.4 | 4.8.4 |
| >=4.0.0<4.8.4 | ||
| =8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/106178
- https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html
- https://security.gentoo.org/glsa/201904-16
- https://www.phpmyadmin.net/security/PMASA-2018-6/
- https://nvd.nist.gov/vuln/detail/CVE-2018-19968
- https://github.com/phpmyadmin/phpmyadmin/commit/6a1ba61e29002f0305a9322a8af4eaaeb11c0732
- https://www.phpmyadmin.net/security/PMASA-2018-6
- https://github.com/advisories/GHSA-xc97-r49q-cxgc (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this phpMyAdmin vulnerability?
The vulnerability ID for this phpMyAdmin vulnerability is CVE-2018-19968.
What is the severity of CVE-2018-19968?
The severity of CVE-2018-19968 is medium.
How can an attacker exploit CVE-2018-19968?
An attacker can exploit CVE-2018-19968 by using the transformation feature in phpMyAdmin before version 4.8.4 to leak the contents of a local file.
What software versions are affected by CVE-2018-19968?
The phpMyAdmin versions before 4.8.4 are affected by CVE-2018-19968.
Are there any references available for CVE-2018-19968?
Yes, you can find references for CVE-2018-19968 at the following links: http://www.securityfocus.com/bid/106178, https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html, and https://security.gentoo.org/glsa/201904-16.
- collector/nvd-index
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-xc97-r49q-cxgc
- alias/CVE-2018-19968
- agent/software-canonical-lookup
- agent/severity
- agent/weakness
- agent/remedy
- agent/references
- agent/description
- agent/author
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/tags
- agent/trending
- vendor/phpmyadmin
- canonical/phpmyadmin phpmyadmin
- version/phpmyadmin phpmyadmin/4.0.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0
- package-manager/composer