Description
show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2, when a configuration file does not exist, allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message about this missing file.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079566.html ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079435.html ↗
- http://www.securityfocus.com/bid/52858 ↗
- https://github.com/phpmyadmin/phpmyadmin/commit/c51817d3b8cb05ff54dca9373c0667e29b8498d4 ↗
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:050 ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079475.html ↗
- http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74608 ↗