Information disclosure in Phpmyadmin

CVE-2012-4219

show_config_errors.php in phpMyAdmin 3.5.x before 3.5.2.1 allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message, related to lack of inclusion of the common.inc.php library file.

Vulnerability class: Information Disclosure

EPSS: 0.023 (81.5th percentile) — read the EPSS interpretation.

Affected products

Phpmyadmin — versions 3.5.0.0, 3.5.1.0, 3.5.2.0
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

cve@mitre.org (x_refsource_CONFIRM, Exploit)
cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
cve@mitre.org (vendor-advisory, x_refsource_SUSE)