CVE-2018-19968
Published: 11 December 2018
An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.
From the Ubuntu security team
It was discovered that there was a bug in the way phpMyAdmin handles the phpMyAdmin Configuration Storage tables. An authenticated attacker could use this vulnerability to cause phpmyAdmin to leak sensitive files.
Priority
Medium
CVSS 3 base score: 6.5
Status
| Package | Release | Status |
|---|---|---|
|
phpmyadmin Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.8.4, 4:4.9.1+dfsg1-2)
|
| Ubuntu 21.04 (Hirsute Hippo) |
Not vulnerable
(4:4.9.2+dfsg1-1)
|
|
| Ubuntu 20.10 (Groovy Gorilla) |
Not vulnerable
(4:4.9.2+dfsg1-1)
|
|
| Ubuntu 20.04 LTS (Focal Fossa) |
Not vulnerable
(4:4.9.2+dfsg1-1)
|
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Released
(4:4.6.6-5ubuntu0.5)
|
|
| Ubuntu 16.04 ESM (Xenial Xerus) |
Ignored
(end of standard support, was needed)
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Needed
|