GitHub Advisoryadvisory · Packagist

GHSA-jvxx-8xxf-5495 phpMyAdmin CSRF Vulnerability

CRITICAL Published 2022-05-17 Modified 2023-11-02 Official page ↗
Aliases
CVE-2016-9866
Ecosystem
Packagist
Packages
phpmyadmin/phpmyadmin
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2023-07-31

Affected packages

• Packagist phpmyadmin/phpmyadmin: >= 4.6.0, < 4.6.5 → fixed in 4.6.5 • Packagist phpmyadmin/phpmyadmin: >= 4.4.0, < 4.4.15.9 → fixed in 4.4.15.9 • Packagist phpmyadmin/phpmyadmin: >= 4.0.0, < 4.0.10.18 → fixed in 4.0.10.18

Description

An issue was discovered in phpMyAdmin. When the arg_separator is different from its default & value, the CSRF token was not properly stripped from the return URL of the preference import action. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.

Related

Alias · CVE (1)

  • CVE-2016-9866 An issue was discovered in phpMyAdmin. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References