GitHub Advisoryadvisory · Packagist

GHSA-mfr9-pcm3-6mwc phpMyAdmin CSRF Vulnerability

MEDIUM Published 2022-05-24 Modified 2023-08-01 Official page ↗
Aliases
CVE-2019-12616
Ecosystem
Packagist
Packages
phpmyadmin/phpmyadmin
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weaknesses
CWE-352
Reviewed
2023-08-01

Affected packages

• Packagist phpmyadmin/phpmyadmin: < 4.9.0 → fixed in 4.9.0

Description

An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken `` tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim.

Related

Alias · CVE (1)

  • CVE-2019-12616 An issue was discovered in phpMyAdmin before 4.9.0. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References