4.4med
CVE-2016-4412
An issue was discovered in phpMyAdmin.
Published 9 y ago · modified 4 mo ago · JSON
CVSS
4.4
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 64%
Public exploits
0
none known
Summary
An issue was discovered in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. The attacker must sniff the user's valid phpMyAdmin token. All 4.0.x versions (prior to 4.0.10.16) are affected.
Exploit prediction (EPSS)
1.02% probability of exploitation in the next 30 days, higher than 64% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 4.4 | CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 3.6 | AV:N/AC:H/Au:S/C:P/I:P/A:N |
Classification
- Weakness
- CWE-254 7PK - Security Features
References
- securityfocus.com /bid/94519 · vdb-entry, x_refsource_BID, x_transferred
- phpmyadmin.net /security/PMASA-2016-57 · x_refsource_CONFIRM, x_transferred
- security.gentoo.org /glsa/201701-32 · vendor-advisory, x_refsource_GENTOO, x_transferred
Sources
- CVE List: CVE-2016-4412
- NVD: CVE-2016-4412
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.