GHSA-wm9c-vcv2-vpqc

Suggest an improvement
Source
https://github.com/advisories/GHSA-wm9c-vcv2-vpqc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-wm9c-vcv2-vpqc/GHSA-wm9c-vcv2-vpqc.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-wm9c-vcv2-vpqc
Aliases
Published
2022-05-14T02:08:58Z
Modified
2024-04-24T17:43:38.063257Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
phpMyAdmin full path disclosure vulnerability
Details

phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message.

Database specific 
{
    "nvd_published_at": "2016-07-03T01:59:00Z",
    "cwe_ids": [
        "CWE-200"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-24T17:16:37Z"
}
References

Affected packages

Packagist / phpmyadmin/phpmyadmin

Package

Name
phpmyadmin/phpmyadmin
Purl
pkg:composer/phpmyadmin/phpmyadmin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0
Fixed
4.0.10.16

Affected versions

4.*

4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.4.1
4.0.4.2
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.0.10
4.0.10.1
4.0.10.2
4.0.10.3
4.0.10.4
4.0.10.5
4.0.10.6
4.0.10.7
4.0.10.8
4.0.10.9

Packagist / phpmyadmin/phpmyadmin

Package

Name
phpmyadmin/phpmyadmin
Purl
pkg:composer/phpmyadmin/phpmyadmin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.4
Fixed
4.4.15.7

Packagist / phpmyadmin/phpmyadmin

Package

Name
phpmyadmin/phpmyadmin
Purl
pkg:composer/phpmyadmin/phpmyadmin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.6
Fixed
4.6.3