CVEvulnerability
CVE-2016-2039
5.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2016-02-20
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 5.3 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
libraries/session.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not properly generate CSRF token values, which allows remote attackers to bypass intended access restrictions by predicting a value.
Affected configurations
• opensuse leap 42.1
• opensuse opensuse 13.1
• opensuse opensuse 13.2
• phpmyadmin phpmyadmin 4.0.0
• phpmyadmin phpmyadmin 4.0.1
• phpmyadmin phpmyadmin 4.0.10
• phpmyadmin phpmyadmin 4.0.10.1
• phpmyadmin phpmyadmin 4.0.10.2
• phpmyadmin phpmyadmin 4.0.10.3
• phpmyadmin phpmyadmin 4.0.10.4
• phpmyadmin phpmyadmin 4.0.10.5
• phpmyadmin phpmyadmin 4.0.10.6
• phpmyadmin phpmyadmin 4.0.10.7
• phpmyadmin phpmyadmin 4.0.10.8
• phpmyadmin phpmyadmin 4.0.10.9
• phpmyadmin phpmyadmin 4.0.10.10
• phpmyadmin phpmyadmin 4.0.10.11
• phpmyadmin phpmyadmin 4.0.10.12
• phpmyadmin phpmyadmin 4.4.0
• phpmyadmin phpmyadmin 4.4.1
• phpmyadmin phpmyadmin 4.4.1.1
• phpmyadmin phpmyadmin 4.4.2
• phpmyadmin phpmyadmin 4.4.3
• phpmyadmin phpmyadmin 4.4.4
• phpmyadmin phpmyadmin 4.4.5
• phpmyadmin phpmyadmin 4.4.6
• phpmyadmin phpmyadmin 4.4.6.1
• phpmyadmin phpmyadmin 4.4.7
• phpmyadmin phpmyadmin 4.4.8
• phpmyadmin phpmyadmin 4.4.9
• phpmyadmin phpmyadmin 4.4.10
• phpmyadmin phpmyadmin 4.4.11
• phpmyadmin phpmyadmin 4.4.12
• phpmyadmin phpmyadmin 4.4.13
• phpmyadmin phpmyadmin 4.4.13.1
• phpmyadmin phpmyadmin 4.4.14.1
• phpmyadmin phpmyadmin 4.4.15
• phpmyadmin phpmyadmin 4.4.15.1
• phpmyadmin phpmyadmin 4.4.15.2
• phpmyadmin phpmyadmin 4.4.15.3
• phpmyadmin phpmyadmin 4.5.0
• phpmyadmin phpmyadmin 4.5.0.1
• phpmyadmin phpmyadmin 4.5.0.2
• phpmyadmin phpmyadmin 4.5.1
• phpmyadmin phpmyadmin 4.5.2
• phpmyadmin phpmyadmin 4.5.3
• fedoraproject fedora 23
• fedoraproject fedora 24
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html Third Party Advisory
- http://www.debian.org/security/2016/dsa-3627 www.debian.org
- http://www.phpmyadmin.net/home_page/security/PMASA-2016-2.php Patch, Vendor Advisory
- https://github.com/phpmyadmin/phpmyadmin/commit/cb7748ac9cffcd1cd0f3081499cd4aafa9d1065e Patch
- https://github.com/phpmyadmin/phpmyadmin/commit/f20970d32c3dfdf82aef7b6c244da1f769043813 Patch
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html Third Party Advisory
- http://www.debian.org/security/2016/dsa-3627 www.debian.org
- http://www.phpmyadmin.net/home_page/security/PMASA-2016-2.php Patch, Vendor Advisory
- https://github.com/phpmyadmin/phpmyadmin/commit/cb7748ac9cffcd1cd0f3081499cd4aafa9d1065e Patch
- https://github.com/phpmyadmin/phpmyadmin/commit/f20970d32c3dfdf82aef7b6c244da1f769043813 Patch