Critical Vulnerability in phpMyAdmin: Git Information Exposure
Summary
UBUNTU-CVE-2019-19617: phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php. Affects phpmyadmin versions < 4:4.0.10-1ubuntu0.1+esm2. Fixed in 4:4.0.10-1ubuntu0.1+esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
phpMyAdmin is a widely-used open-source tool for managing MySQL databases through a web interface. It allows users to perform various database operations, including creating, modifying, and deleting databases and tables. The tool is popular among developers and database administrators for its ease of use and extensive features. However, certain versions of phpMyAdmin are vulnerable to a security flaw that exposes sensitive Git information, potentially compromising the integrity of the application.
Vulnerability Detail
The vulnerability, identified as CVE-2019-19617, affects phpMyAdmin versions prior to 4.9.2. It arises from improper escaping of Git information in specific files, namely libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php. This flaw can lead to unauthorized disclosure of sensitive information, which may be exploited by attackers to gain insights into the application's structure and potentially launch further attacks. The CVSS score for this vulnerability is 9.8, indicating a critical severity level.
How To Fix
Minimum fixed version
4:4.0.10-1ubuntu0.1+esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to the phpMyAdmin interface by implementing IP whitelisting or using a VPN to limit exposure to trusted networks. Additionally, ensure that sensitive information is not stored in the Git repository accessible by phpMyAdmin.
Conclusion
In summary, CVE-2019-19617 is a critical vulnerability affecting phpMyAdmin that can expose sensitive Git information. Users are strongly advised to update to the latest patched versions to mitigate the risk. Implementing workarounds can provide temporary relief, but updating is the most effective solution.
See every vulnerability recorded for phpmyadmin →
FAQ
CVE-2019-19617 is a critical vulnerability in phpMyAdmin that exposes sensitive Git information due to improper escaping in certain files.
Versions of phpMyAdmin prior to 4.9.2 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability can lead to unauthorized disclosure of sensitive information, which may be exploited by attackers to compromise the application.
The CVSS score of CVE-2019-19617 is 9.8, indicating a critical severity level.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
