{"id":"CVE-2018-19969","published":"2018-12-11T17:00:00Z","modified":"2024-08-05T11:51:17Z","title":"phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws","vendor":null,"product":null,"tier":"tail","description":{"text":"phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible to perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting designer pages, adding/deleting users, updating user passwords, killing SQL processes, etc.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01065,"percentile":0.64568,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.securityfocus.com/bid/106175","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2018-7/","tags":["x_refsource_CONFIRM"]},{"url":"https://security.gentoo.org/glsa/201904-16","tags":["vendor-advisory","x_refsource_GENTOO"]}],"priority":{"score":12.9,"factors":[{"name":"EPSS percentile","points":12.91}]},"affected":[{"ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","vulnerableRanges":[">=4.8, <4.8.4",">=4.7, <=4.7.6"],"patched":["4.8.4"],"from":["GHSA-xwf2-53mc-r8hx"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5870","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2018-12613","published":"2018-06-21","fixed":"4.8.2","kev":false},{"cve":"CVE-2018-15605","published":"2018-08-24","fixed":"4.8.3","kev":false,"link":{"from":"CVE-2018-15605","to":"CVE-2018-19969","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:phpmyadmin/phpmyadmin","fromFixed":"4.8.3","toFixed":"4.8.4","daysApart":109}]}},{"cve":"CVE-2018-19968","published":"2018-12-11","fixed":"4.8.4","kev":false},{"cve":"CVE-2018-19969","published":"2018-12-11","fixed":"4.8.4","kev":false},{"cve":"CVE-2018-19970","published":"2018-12-11","fixed":"4.8.4","kev":false},{"cve":"CVE-2019-6798","published":"2019-01-26","fixed":"4.8.5","kev":false,"link":{"from":"CVE-2018-19969","to":"CVE-2019-6798","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:phpmyadmin/phpmyadmin","fromFixed":"4.8.4","toFixed":"4.8.5","daysApart":46}]}},{"cve":"CVE-2019-6799","published":"2019-01-26","fixed":"4.8.5","kev":false,"link":{"from":"CVE-2018-19969","to":"CVE-2019-6799","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:phpmyadmin/phpmyadmin","fromFixed":"4.8.4","toFixed":"4.8.5","daysApart":46}]}}],"package":"Packagist:phpmyadmin/phpmyadmin"}}