GitHub Advisoryadvisory · Packagist

GHSA-2p7v-jm8m-g3qq phpMyAdmin vulnerable to Cross-Site Request Forgery

HIGH Published 2022-05-14 Modified 2025-04-14 Official page ↗
Aliases
CVE-2016-5739
Ecosystem
Packagist
Packages
phpmyadmin/phpmyadmin
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2025-04-14

Affected packages

• Packagist phpmyadmin/phpmyadmin: >= 4.0.10.0, < 4.0.10.16 → fixed in 4.0.10.16 • Packagist phpmyadmin/phpmyadmin: >= 4.4.15.0, < 4.4.15.7 → fixed in 4.4.15.7 • Packagist phpmyadmin/phpmyadmin: >= 4.6.0, < 4.6.3 → fixed in 4.6.3

Description

The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy (CSP) protection mechanism, which makes it easier for remote attackers to conduct CSRF attacks by reading an authentication token in a Referer header, related to libraries/Header.php.

Related

Alias · CVE (1)

  • CVE-2016-5739 The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References