CVE-2019-12922: phpMyAdmin Cross-Site Request Forgery (CSRF)
Summary
CVE-2019-12922: phpMyAdmin Cross-Site Request Forgery (CSRF). Affects phpmyadmin/phpmyadmin versions < 4.9.1. Fixed in 4.9.1. How to fix ↓
Also tracked for
- phpmyadmin · Debian:11
The same CVE-2019-12922 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source administration tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks. The vulnerability identified as CVE-2019-12922 is a Cross-Site Request Forgery (CSRF) issue that affects phpMyAdmin version 4.9.0.1. This vulnerability allows an attacker to delete any server listed in the Setup page of phpMyAdmin.
Vulnerability Detail
The CSRF vulnerability in phpMyAdmin 4.9.0.1 enables an attacker to trick an authenticated user into performing unwanted actions on their behalf. By crafting a malicious request and enticing the user to visit a specially crafted webpage or click on a malicious link, the attacker can delete any server configured in phpMyAdmin. This can lead to unauthorized access, data loss, or disruption of database operations. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
4.9.1
This is the first release that contains the fix.
composer require phpmyadmin/phpmyadmin:4.9.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, users can implement a temporary workaround by disabling the Setup page in phpMyAdmin. This can be achieved by modifying the configuration file to remove or comment out the 'Setup' entry. However, it is crucial to note that this workaround only mitigates the CSRF vulnerability and does not provide a permanent solution. Upgrading to the latest version is still recommended.
Conclusion
The CSRF vulnerability in phpMyAdmin 4.9.0.1 poses a moderate risk to the security and integrity of MySQL databases. Upgrading to the latest version, 4.9.1 or later, is the recommended solution to mitigate this vulnerability. Alternatively, users can implement a temporary workaround by disabling the Setup page. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source administration tool for managing MySQL databases. It provides a web-based interface for performing various database management tasks.
A CSRF (Cross-Site Request Forgery) vulnerability allows an attacker to trick an authenticated user into performing unwanted actions on their behalf without their knowledge or consent.
The vulnerability allows an attacker to delete any server listed in the Setup page of phpMyAdmin. This can lead to unauthorized access, data loss, or disruption of database operations.
To fix this vulnerability, it is recommended to upgrade phpMyAdmin to version 4.9.1 or later. The latest version includes a patch that addresses the CSRF issue.
Yes, a temporary workaround is to disable the Setup page in phpMyAdmin by modifying the configuration file. However, upgrading to the latest version is still recommended for a permanent solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
