Bug 2563957 (CVE-2026-119428)
| Summary: | CVE-2026-119428 phpMyAdmin: phpMyAdmin: Server-Side Request Forgery via setup validation script | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in phpMyAdmin. This Server-Side Request Forgery (SSRF) vulnerability allows an unauthenticated remote attacker to trigger outbound network connections by submitting custom host and port values to the setup validation script. By inspecting the returned connection error messages, an attacker can probe internal network services and map inaccessible network infrastructure.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2565541, 2565542, 2565543, 2565544, 2565545 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-10-30 12:16:57 UTC
|