vulnwire
7.5high

CVE-2016-5706

phpMyAdmin Denial Of Service (DOS) attack

Also known as GHSA-9rmm-8fp4-26hv

Published 10 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.8%
percentile 87%
Public exploits
0
none known

js/get_scripts.js.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to cause a denial of service via a large array in the scripts parameter.

Exploit prediction (EPSS)

2.81% probability of exploitation in the next 30 days, higher than 87% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD2.05.0AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub3.07.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

EcosystemPackageAffectedFixed in
packagistphpmyadmin/phpmyadmin
>=4.0, <4.0.10.16
>=4.4, <4.4.15.7
>=4.6, <4.6.3
4.0.10.16
4.4.15.7
4.6.3

Classification

Weakness
  • CWE-399 Resource Management Errors
  • CWE-400 Uncontrolled Resource Consumption

References

  • github.com /phpmyadmin/phpmyadmin/commit/4767f24ea4c1e3822ce71a636c341e8ad8d07aa6 · x_refsource_CONFIRM, x_transferred
  • lists.opensuse.org /opensuse-updates/2016-06/msg00114.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • phpmyadmin.net /security/PMASA-2016-22/ · x_refsource_CONFIRM, x_transferred
  • debian.org /security/2016/dsa-3627 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • securityfocus.com /bid/91376 · vdb-entry, x_refsource_BID, x_transferred
  • security.gentoo.org /glsa/201701-32 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • lists.opensuse.org /opensuse-updates/2016-06/msg00113.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2016-5706 · advisory
  • github.com /phpmyadmin/phpmyadmin/commit/805225a28c1428d7809e613c731c2126960e98df · web
  • github.com /phpmyadmin/phpmyadmin/commit/abb3685c8702de887988fee31a97ef4d80d856a1 · web
  • github.com /phpmyadmin/composer · package
  • phpmyadmin.net /security/PMASA-2016-22 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.