PMASA-2011-15
Announcement-ID: PMASA-2011-15
Date: 2011-10-17
Summary
Path disclosure due to insufficient url parameter validation.
Description
When the js_frame parameter of phpmyadmin.css.php is defined as an array, an error message shows the full path of this file, leading to possible further attacks.
Severity
We consider this vulnerability to be non critical.
Mitigation factor
For the error messages to be displayed, php.ini's error_reporting must be set to E_ALL and display_errors must be On (these settings are not recommended on a production server in the PHP manual).
Affected Versions
Versions 3.4.x are affected.
Solution
Upgrade to phpMyAdmin 3.4.6 or newer or apply the related patch listed below.
References
Thanks to Mihail Ursu for reporting this issue.
Assigned CVE IDs: CVE-2011-3646
Patches
The following commits have been made to fix this issue:
The following commits have been made on the 3.4 branch to fix this issue:
More information
For further information and in case of questions, please contact the phpMyAdmin security team at security@phpmyadmin.net.