Lucene search

[email protected]CVE-2014-8959

HistoryNov 30, 2014 - 11:59 a.m.

CVE-2014-8959

2014-11-3011:59:01

CWE-22

[email protected]

web.nvd.nist.gov

cve

directory traversal

vulnerability

phpmyadmin

nvd

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

6.5 Medium

AI Score

Confidence

Low

0.018 Low

EPSS

Percentile

88.2%

JSON

Directory traversal vulnerability in libraries/gis/GIS_Factory.class.php in the GIS editor in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allows remote authenticated users to include and execute arbitrary local files via a crafted geometry-type parameter.

Affected configurations

NVD

Node

opensuseopensuseMatch12.3

opensuseopensuseMatch13.1

opensuseopensuseMatch13.2

Node

phpmyadminphpmyadminMatch4.0.0

phpmyadminphpmyadminMatch4.0.0rc2

phpmyadminphpmyadminMatch4.0.0rc3

phpmyadminphpmyadminMatch4.0.1

phpmyadminphpmyadminMatch4.0.2

phpmyadminphpmyadminMatch4.0.3

phpmyadminphpmyadminMatch4.0.4

phpmyadminphpmyadminMatch4.0.4.1

phpmyadminphpmyadminMatch4.0.4.2

phpmyadminphpmyadminMatch4.0.5

phpmyadminphpmyadminMatch4.0.6

phpmyadminphpmyadminMatch4.0.7

phpmyadminphpmyadminMatch4.0.8

phpmyadminphpmyadminMatch4.0.9

phpmyadminphpmyadminMatch4.0.10

phpmyadminphpmyadminMatch4.0.10.0

phpmyadminphpmyadminMatch4.0.10.1

phpmyadminphpmyadminMatch4.0.10.2

phpmyadminphpmyadminMatch4.0.10.3

phpmyadminphpmyadminMatch4.0.10.4

phpmyadminphpmyadminMatch4.0.10.5

phpmyadminphpmyadminMatch4.1.0

phpmyadminphpmyadminMatch4.1.1

phpmyadminphpmyadminMatch4.1.2

phpmyadminphpmyadminMatch4.1.3

phpmyadminphpmyadminMatch4.1.4

phpmyadminphpmyadminMatch4.1.5

phpmyadminphpmyadminMatch4.1.6

phpmyadminphpmyadminMatch4.1.7

phpmyadminphpmyadminMatch4.1.8

phpmyadminphpmyadminMatch4.1.9

phpmyadminphpmyadminMatch4.1.10

phpmyadminphpmyadminMatch4.1.11

phpmyadminphpmyadminMatch4.1.12

phpmyadminphpmyadminMatch4.1.13

phpmyadminphpmyadminMatch4.1.14

phpmyadminphpmyadminMatch4.1.14.1

phpmyadminphpmyadminMatch4.1.14.2

phpmyadminphpmyadminMatch4.1.14.3

phpmyadminphpmyadminMatch4.1.14.4

phpmyadminphpmyadminMatch4.1.14.5

phpmyadminphpmyadminMatch4.1.14.6

phpmyadminphpmyadminMatch4.2.0

phpmyadminphpmyadminMatch4.2.1

phpmyadminphpmyadminMatch4.2.2

phpmyadminphpmyadminMatch4.2.3

phpmyadminphpmyadminMatch4.2.4

phpmyadminphpmyadminMatch4.2.5

phpmyadminphpmyadminMatch4.2.6

phpmyadminphpmyadminMatch4.2.7

phpmyadminphpmyadminMatch4.2.7.1

phpmyadminphpmyadminMatch4.2.8

phpmyadminphpmyadminMatch4.2.8.1

phpmyadminphpmyadminMatch4.2.9

phpmyadminphpmyadminMatch4.2.10

phpmyadminphpmyadminMatch4.2.11

CPENameOperatorVersion
opensuse:opensuseopensuseeq12.3
opensuse:opensuseopensuseeq13.1
opensuse:opensuseopensuseeq13.2

CPE	Name	Operator	Version
opensuse:opensuse	opensuse	eq	12.3
opensuse:opensuse	opensuse	eq	13.1
opensuse:opensuse	opensuse	eq	13.2

References

lists.opensuse.org/opensuse-updates/2014-12/msg00017.html

www.mandriva.com/security/advisories?name=MDVSA-2014:228

www.phpmyadmin.net/home_page/security/PMASA-2014-14.php

www.securityfocus.com/bid/71247

github.com/phpmyadmin/phpmyadmin/commit/80cd40b6687a6717860d345d6eb55bef2908e961

security.gentoo.org/glsa/201505-03

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

6.5 Medium

AI Score

Confidence

Low

0.018 Low

EPSS

Percentile

88.2%

JSON

Related for CVE-2014-8959

phpmyadmin1 ubuntucve1 debiancve1 prion1 cvelist1 nvd1 seebug1 openvas7 typo31 nessus8 fedora3 securityvulns2 freebsd1 mageia1 gentoo1