VulnerabilityModified
CVE-2014-8959
Directory traversal vulnerability in libraries/gis/GIS_Factory.class.php in the GIS editor in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allows remote authenticated users to include and execute arbitrary local files…
MEDIUM 6.5EPSS 2.73%
Does this matter?
Lower severity and a low EPSS score (2.73%). Track it; it rarely justifies an emergency change on its own.
Description
Directory traversal vulnerability in libraries/gis/GIS_Factory.class.php in the GIS editor in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allows remote authenticated users to include and execute arbitrary local files via a crafted geometry-type parameter.
- CVSS 2.0
- 6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
- EPSS
- 2.73% probability · 85th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- opensuse/opensuse · phpmyadmin/phpmyadmin
- Source
- cve@mitre.org
References
- http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.htmlThird Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:228Broken Link
- http://www.phpmyadmin.net/home_page/security/PMASA-2014-14.phpVendor Advisory
- http://www.securityfocus.com/bid/71247
- https://github.com/phpmyadmin/phpmyadmin/commit/80cd40b6687a6717860d345d6eb55bef2908e961Exploit
- https://security.gentoo.org/glsa/201505-03
- http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.htmlThird Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:228Broken Link
- http://www.phpmyadmin.net/home_page/security/PMASA-2014-14.phpVendor Advisory
- http://www.securityfocus.com/bid/71247
- https://github.com/phpmyadmin/phpmyadmin/commit/80cd40b6687a6717860d345d6eb55bef2908e961Exploit
- https://security.gentoo.org/glsa/201505-03
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.