Description
phpMyAdmin before 2.9.1-rc1 has a libraries directory under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via direct requests for certain files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | phpmyadmin | 4:2.9.0.2-0.1 | — |
| Debian 13 | phpmyadmin | 4:2.9.0.2-0.1 | — |
| Debian 12 | phpmyadmin | 4:2.9.0.2-0.1 | — |
References
- 22126 third-party-advisory
- 20253 vdb-entry
- http://prdownloads.sourceforge.net/phpmyadmin/phpMyAdmin-2.9.1-rc1.tar.gz?download
- 23086 third-party-advisory
- SUSE-SA:2006:071 vendor-advisory