vulnwire
7.5high

CVE-2016-5739

phpMyAdmin vulnerable to Cross-Site Request Forgery

Also known as GHSA-2p7v-jm8m-g3qq

Published 10 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.9%
percentile 87%
Public exploits
0
none known

The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy (CSP) protection mechanism, which makes it easier for remote attackers to conduct CSRF attacks by reading an authentication token in a Referer header, related to libraries/Header.php.

Exploit prediction (EPSS)

2.95% probability of exploitation in the next 30 days, higher than 87% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N
GitHub3.07.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

EcosystemPackageAffectedFixed in
packagistphpmyadmin/phpmyadmin
>=4.0.10.0, <4.0.10.16
>=4.4.15.0, <4.4.15.7
>=4.6.0, <4.6.3
4.0.10.16
4.4.15.7
4.6.3

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

  • lists.opensuse.org /opensuse-updates/2016-06/msg00114.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • github.com /phpmyadmin/phpmyadmin/commit/2f4950828ec241e8cbdcf13090c2582a6fa620cb · x_refsource_CONFIRM, x_transferred
  • phpmyadmin.net /security/PMASA-2016-28/ · x_refsource_CONFIRM, x_transferred
  • debian.org /security/2016/dsa-3627 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • securityfocus.com /bid/91389 · vdb-entry, x_refsource_BID, x_transferred
  • github.com /phpmyadmin/phpmyadmin/commit/1e5716cb96d46efc305381ae0da08e73fe340f05 · x_refsource_CONFIRM, x_transferred
  • security.gentoo.org /glsa/201701-32 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • lists.opensuse.org /opensuse-updates/2016-06/msg00113.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2016-5739 · advisory
  • github.com /phpmyadmin/phpmyadmin · package
  • web.archive.org /web/20200227223419/http://www.securityfocus.com/bid/91389 · web
  • phpmyadmin.net /security/PMASA-2016-28 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.