GitHub Advisoryadvisory · Packagist

GHSA-j2cq-h6v2-f875 phpMyAdmin Cookie attribute injection attack

HIGH Published 2022-05-17 Modified 2024-04-24 Official page ↗
Aliases
CVE-2017-1000016
Ecosystem
Packagist
Packages
phpmyadmin/phpmyadmin
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20
Reviewed
2024-04-24

Affected packages

• Packagist phpmyadmin/phpmyadmin: >= 4.6, < 4.6.6 → fixed in 4.6.6

Description

A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies. This is a re-issue of an incomplete fix from PMASA-2016-18.

Related

Alias · CVE (1)

  • CVE-2017-1000016 A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References