CVE-2019-12922
Published: 13 September 2019
A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.
From the Ubuntu Security Team
It was discovered that phpmyadmin incorrectly handled some requests. An attacker could possibly use this to perform a CSRF attack.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
phpmyadmin
Launchpad, Ubuntu, Debian |
bionic |
Released
(4:4.6.6-5ubuntu0.5+esm1)
Available with Ubuntu Pro |
| disco |
Ignored
(end of life)
|
|
| eoan |
Does not exist
|
|
| focal |
Not vulnerable
(4:4.9.2+dfsg1-1)
|
|
| groovy |
Not vulnerable
(4:4.9.2+dfsg1-1)
|
|
| hirsute |
Not vulnerable
(4:4.9.2+dfsg1-1)
|
|
| impish |
Not vulnerable
(4:4.9.2+dfsg1-1)
|
|
| jammy |
Not vulnerable
(4:4.9.2+dfsg1-1)
|
|
| kinetic |
Not vulnerable
(4:4.9.2+dfsg1-1)
|
|
| lunar |
Not vulnerable
(4:4.9.2+dfsg1-1)
|
|
| trusty |
Released
(4:4.0.10-1ubuntu0.1+esm1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| upstream |
Released
(4:4.9.1+dfsg1-2)
|
|
| xenial |
Released
(4:4.5.4.1-2ubuntu2.1+esm3)
Available with Ubuntu Pro |
|
|
Patches:
upstream: https://github.com/phpmyadmin/phpmyadmin/commit/427fbed55d3154d96ecfc1c7784d49eaa3c04161 |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 6.5 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | High |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |