CVE-2019-12922: fedoraproject fedora Cross-Site Request Forgery (CSRF)
CVSS: 6.5v3.1MediumModified
AliasesopenSUSE-SU-2019:2211-1UBUNTU-CVE-2019-12922DEBIAN-CVE-2019-12922
Published 13-09-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-12922 is a medium (CVSS 6.5) Cross-Site Request Forgery (CSRF) vulnerability in fedoraproject fedora. EPSS estimates a 10.67% chance of exploitation in the next 30 days, higher than 95.7% of scored vulnerabilities. 3 public exploits are recorded.
CVSS score
6.5/10
010
Medium · v3.1 (NVD)EPSS score
10.67%
0%100%
Medium · +0.53 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits3reference, exploit-database
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 13-09-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.
CVSS metrics
4 scores · 3 sources · 2 versionsMedium 6.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Medium 5.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:P/A:PSourcesSingle source
EPSS trend
Probability
10.67%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
+0.53 pp
From 10.14% on 19-09-2026
19-09-202619-10-2026
EPSS score10.67%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
phpMyAdmin 4.9.0.1 - Cross-Site Request Forgery
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Suse3 products
- phpMyAdmin&distro=SUSE Package Hub 12< 4.9.1-bp151.3.6.1
- phpMyAdmin&distro=SUSE Package Hub 15< 4.9.1-bp151.3.6.1
- phpMyAdmin&distro=SUSE Package Hub 15 SP1< 4.9.1-bp151.3.6.1
Opensuse2 products
- phpMyAdmin&distro=openSUSE Leap 15.0< 4.9.1-bp151.3.6.1
- phpMyAdmin&distro=openSUSE Leap 15.1< 4.9.1-bp151.3.6.1
Debian1 product
- phpmyadmin< 4:4.9.1+dfsg1-2
Fedoraproject1 product
- fedoraEOL29 | 30 | 31
Phpmyadmin1 product
- phpmyadmin≤ 4.9.0.1
Ubuntu1 product
- phpmyadmin< 4:4.0.10-1ubuntu0.1+esm1 | < 4:4.5.4.1-2ubuntu2.1+esm3 | < 4:4.6.6-5ubuntu0.5+esm1
6 vendors · 9 products
References
17 links- seclists.org/fulldisclosure/2019/Sep/23X Refsource MISCExploitMailing ListThird Party AdvisoryREPORT
- packetstormsecurity.com/files/154483/phpMyAdmin-4.9.0.1-Cross-Site-Request-Forgery.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00078.htmlVendor AdvisoryX Refsource SUSEBroken Link
- github.com/phpmyadmin/phpmyadmin/commit/427fbed55d3154d96ecfc1c7784d49eaa3c04161X Refsource MISCPatchThird Party Advisory
- github.com/phpmyadmin/phpmyadmin/commit/7d21d4223bdbe0306593309132b4263d7087d13bX Refsource MISCPatchThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
Show all 17 references
- lists.opensuse.org/archives/…Advisory
