CVE-2024-54141

phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available

State: Published
Severity: 8.6 High
Published: Dec 6, 2024
Updated: Dec 6, 2024
Reserved: Nov 29, 2024

Description

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Prior to 4.0.0, phpMyFAQ exposes the database (ie postgreSQL) server's credential when connection to DB fails. This vulnerability is fixed in 4.0.0.

Scores

CVSS	Score	Vector	Source
3.1	8.6 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L	GitHub_M

Weaknesses

CWE-209 Generation of Error Message Containing Sensitive Information

Affected Products

Product	Versions
phpMyFAQthorsten	< 4.0.0Affected

References

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-vrjr-p3xp-xx2x
https://github.com/thorsten/phpMyFAQ/commit/b9289a0b2233df864361c131cd177b6715fbb0fe

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.