Upstream information
Description
An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.SUSE information
Overall state of this security issue: Does not affect SUSE products
This issue is currently rated as having moderate severity.
National Vulnerability Database | |
---|---|
Base Score | 4 |
Vector | AV:N/AC:L/Au:S/C:P/I:N/A:N |
Access Vector | Network |
Access Complexity | Low |
Authentication | Single |
Confidentiality Impact | Partial |
Integrity Impact | None |
Availability Impact | None |
National Vulnerability Database | |
---|---|
Base Score | 6.5 |
Vector | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Access Vector | Network |
Access Complexity | Low |
Privileges Required | Low |
User Interaction | None |
Scope | Unchanged |
Confidentiality Impact | High |
Integrity Impact | None |
Availability Impact | None |
CVSSv3 Version | 3 |
- openSUSE-SU-2018:4124-1, published Fri, 14 Dec 2018 18:10:09 +0100 (CET)
- openSUSE-SU-2018:4125-1, published Fri, 14 Dec 2018 18:10:36 +0100 (CET)
List of released packages
Product(s) | Fixed package version(s) | References |
---|---|---|
SUSE Package Hub 12 |
| Patchnames: openSUSE-2019-1009 |
SUSE Package Hub 15 |
| Patchnames: openSUSE-2019-1009 |
openSUSE Leap 15.0 |
| Patchnames: openSUSE-2019-1009 |
openSUSE Tumbleweed |
| Patchnames: openSUSE Tumbleweed GA phpMyAdmin-5.1.1-1.2 |