VulnerabilityModified
CVE-2008-1924
Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir…
LOW 3.5EPSS 1.63%
Does this matter?
Lower severity and a low EPSS score (1.63%). Track it; it rarely justifies an emergency change on its own.
Description
Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir variable.
- CVSS 2.0
- 3.5 LOWAV:N/AC:M/Au:S/C:P/I:N/A:N
- EPSS
- 1.63% probability · 75th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- phpmyadmin/phpmyadmin
- Source
- cve@mitre.org
References
- http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html
- http://secunia.com/advisories/29944Vendor Advisory
- http://secunia.com/advisories/29964Vendor Advisory
- http://secunia.com/advisories/30034Vendor Advisory
- http://secunia.com/advisories/30816Vendor Advisory
- http://secunia.com/advisories/32834Vendor Advisory
- http://secunia.com/advisories/33822Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200805-02.xml
- http://www.debian.org/security/2008/dsa-1557
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:131
- http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3Vendor Advisory
- http://www.securityfocus.com/bid/28906Patch
- http://www.vupen.com/english/advisories/2008/1328/referencesVendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41964
- http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html
- http://secunia.com/advisories/29944Vendor Advisory
- http://secunia.com/advisories/29964Vendor Advisory
- http://secunia.com/advisories/30034Vendor Advisory
- http://secunia.com/advisories/30816Vendor Advisory
- http://secunia.com/advisories/32834Vendor Advisory
- http://secunia.com/advisories/33822Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200805-02.xml
- http://www.debian.org/security/2008/dsa-1557
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:131
- http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3Vendor Advisory
- http://www.securityfocus.com/bid/28906Patch
- http://www.vupen.com/english/advisories/2008/1328/referencesVendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41964
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.