CVE-2019-19617: Critical severity phpmyadmin vulnerability
phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php.
Other sources
phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-19617?
CVE-2019-19617 is a vulnerability in phpMyAdmin before version 4.9.2 that allows certain Git information to be displayed without proper escaping, potentially leading to cross-site scripting (XSS) attacks.
How severe is CVE-2019-19617?
CVE-2019-19617 has a severity rating of 9.8 out of 10, making it a critical vulnerability.
Which software versions are affected by CVE-2019-19617?
phpMyAdmin versions before 4.9.2 and Debian Linux versions 8.0 and 9.0 are affected by CVE-2019-19617.
How can I fix CVE-2019-19617?
To fix CVE-2019-19617, you should update phpMyAdmin to version 4.9.2 or later.
Where can I find more information about CVE-2019-19617?
More information about CVE-2019-19617 can be found at the following references: - [GitHub Commit](https://github.com/phpmyadmin/phpmyadmin/commit/1119de642b136d20e810bb20f545069a01dd7cc9) - [GitHub Comparison](https://github.com/phpmyadmin/phpmyadmin/compare/RELEASE_4_9_1...RELEASE_4_9_2) - [Debian LTS Announcement](https://lists.debian.org/debian-lts-announce/2019/12/msg00006.html)