GitHub Advisoryadvisory · Packagist

GHSA-xqw9-ffx7-g998 phpMyAdmin cookie-attribute injection

LOW Published 2022-05-17 Modified 2023-11-02 Official page ↗
Aliases
CVE-2016-5702
Ecosystem
Packagist
Packages
phpmyadmin/phpmyadmin
Severity
Low
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Reviewed
2023-07-31

Affected packages

• Packagist phpmyadmin/phpmyadmin: >= 4.6.0, < 4.6.3 → fixed in 4.6.3

Description

phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHP_SELF value, allows remote attackers to conduct cookie-attribute injection attacks via a crafted URI.

Related

Alias · CVE (1)

  • CVE-2016-5702 phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHP_SELF value, allows remote attackers to conduct cookie-attribute injection… vulnerability

References