CVE-2019-10784

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2019-10784

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-10784.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2019-10784

Related

Published

2020-02-04T19:15:10Z

Modified

2025-01-08T05:37:36.557114Z

Severity

9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from the application. One such area, "database.php" does not verify the source of an HTTP request. This can be leveraged by a remote attacker to trick a logged-in administrator to visit a malicious page with a CSRF exploit and execute arbitrary system commands on the server.

References

Affected packages

Debian:13 / phppgadmin

Package

Name: phppgadmin
Purl: pkg:deb/debian/phppgadmin?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.14.7+dfsg-1

Affected versions

7.*

7.13.0+dfsg-2

7.13.0+dfsg-3

7.14.7+dfsg-1~bpo12+1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/phppgadmin/phppgadmin

Affected ranges

Type: GIT
Repo: https://github.com/phppgadmin/phppgadmin
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

46944bf9bff6642eb8eb26d4fceb211a65deede3

Affected versions

Other

REL_0-5-0

REL_0-6-0

REL_0-6-5

REL_3-0-0-DEV-1

REL_3-0-0-DEV-2

REL_3-0-0-DEV-3

REL_3-0-0-DEV-4

REL_3-0-BETA-1

REL_3-0-RC-1

REL_3-0-RC-2

REL_3-1-BETA-1

REL_3-1-RC-1

REL_4-1-BETA-1

REL_4-2-BETA-1

REL_4-2-BETA-2

REL_5-0-BETA-1

REL_5-0-BETA-2

REL_5-1-0

REL_5-6-0

REL_7-12-1