Vulnerability Description
phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible to perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting designer pages, adding/deleting users, updating user passwords, killing SQL processes, etc.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Phpmyadmin | Phpmyadmin | >= 4.7.0, <= 4.7.6 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/106175Third Party AdvisoryVDB Entry
- https://security.gentoo.org/glsa/201904-16Third Party Advisory
- https://www.phpmyadmin.net/security/PMASA-2018-7/PatchVendor Advisory
- http://www.securityfocus.com/bid/106175Third Party AdvisoryVDB Entry
- https://security.gentoo.org/glsa/201904-16Third Party Advisory
- https://www.phpmyadmin.net/security/PMASA-2018-7/PatchVendor Advisory
FAQ
What is CVE-2018-19969?
CVE-2018-19969 is a vulnerability with a CVSS score of 8.8 (HIGH). phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible to perform harmful SQL operations such as ...
How severe is CVE-2018-19969?
CVE-2018-19969 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-19969?
Check the references section above for vendor advisories and patch information. Affected products include: Phpmyadmin Phpmyadmin.