Description

A full path disclosure vulnerability was discovered in phpMyAdmin where a user can trigger a particular error in the export mechanism to discover the full path of phpMyAdmin on the disk. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.

Remediation

References

CVE-2016-6610

Related Vulnerabilities

Oracle HTTP Server Out-of-bounds Write Vulnerability (CVE-2022-23943)

WordPress Plugin Infusionsoft Gravity Forms Add-on Multiple Cross-Site Scripting Vulnerabilities (1.5.6)

Apache HTTP Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2000-1205)

Plone CMS Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2012-5493)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-30154)

Severity

Medium

Classification

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities CWE-200 CVE-2016-6610