CVE-2012-1902

show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2, when a configuration file does not...

4.3 MediumFix available

show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2, when a configuration file does not exist, allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message about this missing file.

Exploit likelihood

2.12%Up 0.7 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2012-1902
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

Record: CVE-2012-1902
Updated: 2026-11-02

EUVDEUVD-2012-1912 No score

Record: EUVD-2012-1912
Updated: 2026-11-03

GitHub AdvisoriesGHSA-4953-8rw3-w7m5 No score

show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2, when a configuration file does not...

Record: GHSA-4953-8rw3-w7m5
Weakness: CWE-200
Updated: 2026-11-02

OSV No score

Record: CVE-2012-1902
Updated: 2026-11-02

OSVDEBIAN-CVE-2012-1902 No score

Record: DEBIAN-CVE-2012-1902
Updated: 2026-11-02

Affected products

phpmyadmin

Affected packages

Affected packages
Package	Affected	Fixed
`phpmyadmin` Debian:12	before 4:3.4.10.2-1	4:3.4.10.2-1
`phpmyadmin` Debian:13	before 4:3.4.10.2-1	4:3.4.10.2-1
`phpmyadmin` Debian:14	before 4:3.4.10.2-1	4:3.4.10.2-1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-1902 is a medium vulnerability (CVSS 4.3) in Phpmyadmin, published April 6, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.12%, the 81st percentile. Fixed in phpmyadmin 4:3.4.10.2-1.

References

Show 5 moreShow less