GitHub Advisoryadvisory · Packagist

GHSA-wm9c-vcv2-vpqc phpMyAdmin full path disclosure vulnerability

MEDIUM Published 2022-05-14 Modified 2024-04-24 Official page ↗
Aliases
CVE-2016-5730
Ecosystem
Packagist
Packages
phpmyadmin/phpmyadmin
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2024-04-24

Affected packages

• Packagist phpmyadmin/phpmyadmin: >= 4.0, < 4.0.10.16 → fixed in 4.0.10.16 • Packagist phpmyadmin/phpmyadmin: >= 4.4, < 4.4.15.7 → fixed in 4.4.15.7 • Packagist phpmyadmin/phpmyadmin: >= 4.6, < 4.6.3 → fixed in 4.6.3

Description

phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message.

Related

Alias · CVE (1)

  • CVE-2016-5730 phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References