CVE-2019-12922 phpMyAdmin Cross-Site Request Forgery (CSRF)
A CSRF vulnerability in phpMyAdmin allows attackers to delete any server configuration via the Setup page.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-12922?
CVE-2019-12922 is a medium-severity vulnerability in Fedoraproject Fedora, published on 13 Sep 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.
Weakness: CWE-352
Which versions are affected by CVE-2019-12922?
2 open source packages ship an affected version, including phpmyadmin/phpmyadmin. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
phpmyadmin/phpmyadmin Packagist | All versions | 4.9.1 |
phpmyadmin/phpmyadmin Packagist | All versions | 4.9.1 |
Linux distribution packages (5)
phpMyAdmin SUSE:Package Hub 12 | All versions | 4.9.1-bp151.3.6.1 |
phpMyAdmin SUSE:Package Hub 15 | All versions | 4.9.1-bp151.3.6.1 |
phpMyAdmin SUSE:Package Hub 15 SP1 | All versions | 4.9.1-bp151.3.6.1 |
phpMyAdmin openSUSE:Leap 15.0 | All versions | 4.9.1-bp151.3.6.1 |
phpMyAdmin openSUSE:Leap 15.1 | All versions | 4.9.1-bp151.3.6.1 |
Products include Fedoraproject Fedora, Phpmyadmin Phpmyadmin.
How do I fix CVE-2019-12922?
Upgrade phpmyadmin/phpmyadmin to 4.9.1 or later.
Is CVE-2019-12922 being exploited?
There is no known exploitation of CVE-2019-12922 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2019-12922, GHSA-4c9q-64gq-xhx4, UBUNTU-CVE-2019-12922, openSUSE-SU-2019:2211-1.