CVE-2018-19968: phpMyAdmin Local file inclusion through… – CVSS 6.5 · Watchpost

← 脆弱性一覧

phpMyAdmin Local file inclusion through transformation feature

中 6.5CVE-2018-19968 · GHSA-xc97-r49q-cxgc · 11/12/2018 公開 · 17/06/2026 更新

要点

CVE-2018-19968 は phpmyadmin/phpmyadmin, phpmyadmin (phpmyadmin) に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：2.9%（全脆弱性の 86.9% より高い）。
対処：4.8.4 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
phpmyadmin/phpmyadmin Packagist	`< 4.8.4`	`4.8.4`
phpmyadmin phpmyadmin	`≥ 4.0.0, < 4.8.4`	`4.8.4`

概要

An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.

NVD の説明

An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.

参考情報

nvd.nist.gov/vuln/detail/CVE-2018-19968 · ADVISORY
phpmyadmin/phpmyadmin commit 6a1ba61 · WEB
phpmyadmin/composer · PACKAGE
lists.debian.org/debian-lts-announce/2019/02/msg00003.html · WEB
security.gentoo.org/glsa/201904-16 · WEB
phpmyadmin.net/security/PMASA-2018-6 · WEB
securityfocus.com/bid/106178 · WEB
phpmyadmin.net/security/PMASA-2018-6 · Patch

phpmyadmin/phpmyadmin のその他の脆弱性

すべて見る →

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン