{"id":"GHSA-c8wj-q36q-3wg4","aliases":["CVE-2019-6799"],"title":"phpMyAdmin Arbitrary file read vulnerability","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allow_local_infile PHP configuration, and the inadvertent ignoring of \"options(MYSQLI_OPT_LOCAL_INFILE\" calls.","severity":"medium","score":5.9,"published":"2022-05-13T01:22:46.000Z","modified":"2024-04-24T18:42:01.817Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"phpmyadmin/phpmyadmin","sources":[{"name":"OSV · GHSA-c8wj-q36q-3wg4","url":"https://osv.dev/vulnerability/GHSA-c8wj-q36q-3wg4"}],"ranges":[{"events":[{"introduced":"4.8"},{"fixed":"4.8.5"}],"type":"ECOSYSTEM"}],"versions":["4.8.0","4.8.0.1","4.8.1","4.8.2","4.8.3","4.8.4"],"fixed":["4.8.5"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2019-6799","https://github.com/phpmyadmin/composer","https://lists.debian.org/debian-lts-announce/2019/02/msg00039.html","https://www.phpmyadmin.net/security/PMASA-2019-1","http://www.securityfocus.com/bid/106736"],"sources":[{"name":"OSV","id":"GHSA-c8wj-q36q-3wg4","modified":"2024-04-24T18:42:01.817056Z","url":"https://osv.dev/vulnerability/GHSA-c8wj-q36q-3wg4"}],"assessments":[{"source":"OSV","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","score":5.9}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T23:25:34.350Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}