CVEvulnerability

CVE-2012-1902

4.3 MEDIUM Published 2012-04-06 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2012-04-06
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200

Description

show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2, when a configuration file does not exist, allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message about this missing file.

Affected configurations

• phpmyadmin phpmyadmin 3.4.0.0 • phpmyadmin phpmyadmin 3.4.1.0 • phpmyadmin phpmyadmin 3.4.2.0 • phpmyadmin phpmyadmin 3.4.3.0 • phpmyadmin phpmyadmin 3.4.3.1 • phpmyadmin phpmyadmin 3.4.3.2 • phpmyadmin phpmyadmin 3.4.4.0 • phpmyadmin phpmyadmin 3.4.5.0 • phpmyadmin phpmyadmin 3.4.6.0 • phpmyadmin phpmyadmin 3.4.7.0 • phpmyadmin phpmyadmin 3.4.7.1 • phpmyadmin phpmyadmin 3.4.8.0 • phpmyadmin phpmyadmin 3.4.9.0 • phpmyadmin phpmyadmin 3.4.10.0 • phpmyadmin phpmyadmin 3.4.10.1

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References