GHSA-rmmf-5xhh-gg27

    Dashboard / Vulnerabilities / GHSA-rmmf-5xhh-gg27

    GHSA-rmmf-5xhh-gg27

    Published: 17 May 2022Last Modified: 8 Nov 2023
    Aliases:
    CVE-2016-9853

    Summary: phpMyAdmin path disclosure

    Details: An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the fopen wrapper issue.

    References: https://nvd.nist.gov/vuln/detail/CVE-2016-9853, https://github.com/phpmyadmin/composer, https://security.gentoo.org/glsa/201701-32, https://web.archive.org/web/20210127193655/http://www.securityfocus.com/bid/94527, https://www.phpmyadmin.net/security/PMASA-2016-63

    Affected packages

    Package

    Name: phpmyadmin/phpmyadmin

    Purl: pkg:composer/phpmyadmin/phpmyadmin

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 4.6.0
    Fixed -4.6.5

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-rmmf-5xhh-gg27 | CVE-DB