Information disclosure in phpMyAdmin - CVE-2013-4998
Published: July 31, 2013 / Updated: July 28, 2020
Vulnerability identifier: #VU32642
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-4998
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to pmd_common.php and other files.
Affected software
phpMyAdmin
Gentoo Linux
Fedora
phpmyadmin (Alpine package)
phpMyAdmin
phpMyAdmin4
Gentoo Linux
Fedora
phpmyadmin (Alpine package)
phpMyAdmin
phpMyAdmin4
How to mitigate CVE-2013-4998
Install update from vendor's website.
phpMyAdmin - update to 3.5.8.2
phpmyadmin (Alpine package) - update to 4.0.4.2-r0
phpMyAdmin - update to 4.0.10.1-1.el6
phpMyAdmin4 - update to 4.0.10.3-2.el5
phpmyadmin (Alpine package) - update to 4.0.4.2-r0
phpMyAdmin - update to 4.0.10.1-1.el6
phpMyAdmin4 - update to 4.0.10.3-2.el5