Directory traversal vulnerability in libraries/error_report.lib.php in phpMyAdmin before 4.6.2-prerelease allows remote attackers to determine the existence of arbitrary files by triggering an error.

The remote host is affected by the vulnerability described in GLSA-201701-32 (phpMyAdmin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in phpMyAdmin. Please       review the CVE identifiers referenced below for details.
  Impact :

    A authenticated remote attacker could exploit these vulnerabilities to       execute arbitrary PHP Code, inject SQL code, or to conduct Cross-Site       Scripting attacks.
    In certain configurations, an unauthenticated remote attacker could       cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This phpMyAdmin update to version 4.4.15.6 fixes the following issues :

Security issues fixed :

  - PMASA-2016-16 (CVE-2016-5099, CWE-661): Self XSS, see     https://www.phpmyadmin.net/security/PMASA-2016-16/

  - PMASA-2016-15 (CVE-2016-5098, CWE-661): File Traversal     Protection Bypass on Error Reporting, see     https://www.phpmyadmin.net/security/PMASA-2016-15/

  - PMASA-2016-14 (CVE-2016-5097, CWE-661): Sensitive Data     in URL GET Query Parameters, see     https://www.phpmyadmin.net/security/PMASA-2016-14/

ID	Name	Product	Family	Type	Severity
96426	GLSA-201701-32 : phpMyAdmin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
91587	openSUSE Security Update : phpMyAdmin (openSUSE-2016-712)	Nessus	SuSE Local Security Checks	Local	medium

Detections

Analytics

CVE-2016-5098

medium

Tenable Plugins

critical

medium