Skip to content
OpenAdvisories
Medium · 5.3 CVE-2016-5730 EUVD-2022-5596GHSA-wm9c-vcv2-vpqc

phpMyAdmin full path disclosure vulnerability

Published Jul 3, 2016 · Updated Aug 6, 2024 · Assigned by mitre

Package: phpmyadmin Package: phpmyadmin Package: phpmyadmin/phpmyadmin Ecosystem: Debian Ecosystem: Packagist Ecosystem: Ubuntu

Description

phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 phpmyadmin 4:4.6.3-1 —
Debian 13 phpmyadmin 4:4.6.3-1 —
Debian 12 phpmyadmin 4:4.6.3-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS phpmyadmin No fix yet —
Ubuntu Pro 14.04 LTS phpmyadmin No fix yet —

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed phpMyAdmin 4.6.5.2-1.1 openSUSE-SU-2024:10054-1

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist phpmyadmin/phpmyadmin >= 4.0, < 4.0.10.16 4.0.10.16 GHSA-wm9c-vcv2-vpqc
Packagist phpmyadmin/phpmyadmin >= 4.4, < 4.4.15.7 4.4.15.7 GHSA-wm9c-vcv2-vpqc
Packagist phpmyadmin/phpmyadmin >= 4.6, < 4.6.3 4.6.3 GHSA-wm9c-vcv2-vpqc

Advisories 1

References