Vulnerability Details CVE-2014-8959
Directory traversal vulnerability in libraries/gis/GIS_Factory.class.php in the GIS editor in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allows remote authenticated users to include and execute arbitrary local files via a crafted geometry-type parameter.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.037
EPSS Ranking 87.5%
CVSS Severity
CVSS v2 Score 6.5
References
- http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:228
- http://www.phpmyadmin.net/home_page/security/PMASA-2014-14.php
- http://www.securityfocus.com/bid/71247
- https://github.com/phpmyadmin/phpmyadmin/commit/80cd40b6687a6717860d345d6eb55bef2908e961
- https://security.gentoo.org/glsa/201505-03
- http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:228
- http://www.phpmyadmin.net/home_page/security/PMASA-2014-14.php
- http://www.securityfocus.com/bid/71247
- https://github.com/phpmyadmin/phpmyadmin/commit/80cd40b6687a6717860d345d6eb55bef2908e961
- https://security.gentoo.org/glsa/201505-03
Products affected by CVE-2014-8959
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.0
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.0
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.1
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.10
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.11
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.12
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.13
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.1
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.2
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.3
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.4
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.5
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.6
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.2
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.3
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.4
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.5
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.6
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.7
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.8
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.9
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.0
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.1
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.10
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.11
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.2
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.3
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.4
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.5
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.6
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7.1
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.8
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.8.1
-
cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.9
-
cpe:2.3:o:opensuse:opensuse:12.3
-
cpe:2.3:o:opensuse:opensuse:13.1
-
cpe:2.3:o:opensuse:opensuse:13.2