CVE-2011-0986

phpMyAdmin 2.11.x < 2.11.11.2 and 3.3.x < 3.3.9.1 - Installation Path Disclosure via Missing File Request

Title source: llm
STIX 2.1

Description

phpMyAdmin 2.11.x before 2.11.11.2, and 3.3.x before 3.3.9.1, does not properly handle the absence of the (1) README, (2) ChangeLog, and (3) LICENSE files, which allows remote attackers to obtain the installation path via a direct request for a nonexistent file.

References (8)

Core 8
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/65424
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0385
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054355.html
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2011:026
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054349.html
Patch, Vendor Advisory x_refsource_confirm
http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/43478

Scores

EPSS 0.0055
EPSS Percentile 68.0%

Details

CWE
CWE-20
Status published
Products (39)
phpmyadmin/phpmyadmin 2.11.0
phpmyadmin/phpmyadmin 2.11.1.0
phpmyadmin/phpmyadmin 2.11.1.1
phpmyadmin/phpmyadmin 2.11.1.2
phpmyadmin/phpmyadmin 2.11.2.0
phpmyadmin/phpmyadmin 2.11.2.1
phpmyadmin/phpmyadmin 2.11.2.2
phpmyadmin/phpmyadmin 2.11.3.0
phpmyadmin/phpmyadmin 2.11.4.0
phpmyadmin/phpmyadmin 2.11.5.0
... and 29 more
Published Feb 14, 2011
Tracked Since Feb 18, 2026