NVD Vulnerability Detail

CVE-2012-1902

Summary	show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2, when a configuration file does not exist, allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message about this missing file.
Publication Date	April 7, 2012, 4:55 a.m.
Registration Date	Jan. 28, 2021, 2:56 p.m.
Last Update	Nov. 21, 2024, 10:38 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079435.html
2	http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079435.html
3	http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079475.html
4	http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079475.html
5	http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079566.html
6	http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079566.html
7	http://www.mandriva.com/security/advisories?name=MDVSA-2012:050
8	http://www.mandriva.com/security/advisories?name=MDVSA-2012:050
9	http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php	Patch Vendor Advisory
10	http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php	Patch Vendor Advisory
11	http://www.securityfocus.com/bid/52858
12	http://www.securityfocus.com/bid/52858
13	https://exchange.xforce.ibmcloud.com/vulnerabilities/74608
14	https://exchange.xforce.ibmcloud.com/vulnerabilities/74608
15	https://github.com/phpmyadmin/phpmyadmin/commit/c51817d3b8cb05ff54dca9373c0667e29b8498d4
16	https://github.com/phpmyadmin/phpmyadmin/commit/c51817d3b8cb05ff54dca9373c0667e29b8498d4

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-200	情報漏えい	https://cwe.mitre.org/data/definitions/200.html

JVN Vulnerability Information

phpMyAdmin の show_config_errors.php における重要な情報を取得される脆弱性

Title	phpMyAdmin の show_config_errors.php における重要な情報を取得される脆弱性
Summary	phpMyAdmin の show_config_errors.php には、設定ファイルが存在しない場合、重要な情報を取得される脆弱性が存在します。
Possible impacts	第三者により、存在しないファイルに関するエラーメッセージ内にインストールパスを表示させる直接のリクエストを介して、重要な情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	March 28, 2012, midnight
Registration Date	April 10, 2012, 11:44 a.m.
Last Update	Sept. 4, 2012, 5:18 p.m.

Affected System

The phpMyAdmin Project

phpMyAdmin 3.4.10.2 未満の 3.4.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-1902	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1902
National Vulnerability Database (NVD)
2	CVE-2012-1902	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-1902

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
Fedora Update Notification
1	FEDORA-2012-5599	http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079566.html
GitHub
2	Fixed local path disclosure vulnerability	https://github.com/phpmyadmin/phpmyadmin/commit/c51817d3b8cb05ff54dca9373c0667e29b8498d4
SECURITY ANNOUNCEMENTS
3	PMASA-2012-2	http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php

Change Log

No	Changed Details	Date of change
0	[2012年04月10日] 掲載 [2012年09月04日] ベンダ情報：Fedora Project (FEDORA-2012-5599) を追加	Feb. 17, 2018, 10:37 a.m.