GitHub Advisoryadvisory · Packagist

GHSA-w8qg-j9fp-hrjf phpMyAdmin Improper Input Validation

MEDIUM Published 2022-05-17 Modified 2024-04-24 Official page ↗
Aliases
CVE-2016-2562
Ecosystem
Packagist
Packages
phpmyadmin/phpmyadmin
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Weaknesses
CWE-20
Reviewed
2024-04-24

Affected packages

• Packagist phpmyadmin/phpmyadmin: >= 4.5, < 4.5.5.1 → fixed in 4.5.5.1

Description

The checkHTTP function in libraries/Config.class.php in phpMyAdmin 4.5.x before 4.5.5.1 does not verify X.509 certificates from api.github.com SSL servers, which allows man-in-the-middle attackers to spoof these servers and obtain sensitive information via a crafted certificate.

Related

Alias · CVE (1)

  • CVE-2016-2562 The checkHTTP function in libraries/Config.class.php in phpMyAdmin 4.5.x before 4.5.5.1 does not verify X.509 certificates from… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References