Vulnerability Details : CVE-2018-19968
An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.
Vulnerability category: Information leak
Products affected by CVE-2018-19968
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*
Threat overview for CVE-2018-19968
Top countries where our scanners detected CVE-2018-19968
Top open port discovered on systems with this issue
80
IPs affected by CVE-2018-19968 20
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2018-19968!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2018-19968
14.68%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 96 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-19968
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:N/A:N |
8.0
|
2.9
|
NIST | |
6.5
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
2.8
|
3.6
|
NIST |
CWE ids for CVE-2018-19968
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-19968
-
https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html
[SECURITY] [DLA 1658-1] phpmyadmin security updateMailing List;Third Party Advisory
-
https://security.gentoo.org/glsa/201904-16
phpMyAdmin: Multiple vulnerabilities (GLSA 201904-16) — Gentoo securityThird Party Advisory
-
https://www.phpmyadmin.net/security/PMASA-2018-6/
phpMyAdmin - Security - PMASA-2018-6Patch;Vendor Advisory
-
http://www.securityfocus.com/bid/106178
phpMyAdmin CVE-2018-19968 Local File Include VulnerabilityThird Party Advisory;VDB Entry
Jump to