Information disclosure in phpMyAdmin - CVE-2012-1902
Published: April 6, 2012 / Updated: July 28, 2020
Vulnerability identifier: #VU32815
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2012-1902
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2, when a configuration file does not exist, allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message about this missing file.
Affected software
phpMyAdmin
phpmyadmin (Alpine package)
phpMyAdmin3
phpMyAdmin
Fedora
phpmyadmin (Alpine package)
phpMyAdmin3
phpMyAdmin
Fedora
How to mitigate CVE-2012-1902
Install update from vendor's website.
phpMyAdmin - update to 3.4.10.2
phpmyadmin (Alpine package) - update to 3.4.10.2-r0
phpMyAdmin3 - update to 3.5.0-1.el5
phpMyAdmin - update to 3.5.0-1.el6
phpmyadmin (Alpine package) - update to 3.4.10.2-r0
phpMyAdmin3 - update to 3.5.0-1.el5
phpMyAdmin - update to 3.5.0-1.el6
External References
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079435.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079475.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079566.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:050
- http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php
- http://www.securityfocus.com/bid/52858
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74608
- https://github.com/phpmyadmin/phpmyadmin/commit/c51817d3b8cb05ff54dca9373c0667e29b8498d4