Download 5.2.1 Try demo Donate

PMASA-2012-3

Announcement-ID: PMASA-2012-3

Date: 2012-08-09

Summary

Path disclosure due to missing library.

Description

The show_config_errors.php script does not include a library, so an error message shows the full path of this file, leading to possible further attacks.

Severity

We consider this vulnerability to be non critical.

Mitigation factor

For the error messages to be displayed, php.ini's error_reporting must be set to E_ALL and display_errors must be On (these settings are not recommended on a production server in the PHP manual).

Affected Versions

Versions 3.5.x before 3.5.2.1 are affected.

Solution

Upgrade to phpMyAdmin 3.5.2.1 or newer or apply the related patch listed below.

References

Thanks to Edgar Galan for reporting this issue.

Assigned CVE ids: CVE-2012-4219

CWE ids: CWE-20 CWE-200

Patches

The following commits have been made to fix this issue:

More information

For further information and in case of questions, please contact the phpMyAdmin team. Our website is phpmyadmin.net.

Announcements