CVE-2016-5702 — Phpmyadmin vulnerability

CWE-2549 documents5 sources

Severity

3.7LOWNVD

EPSS

0.2%

top 51.93%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Phpmyadmin Debian Phpmyadmin

Timeline

PublishedJul 3

Latest updateMay 17

Description

phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHP_SELF value, allows remote attackers to conduct cookie-attribute injection attacks via a crafted URI.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 2.2 | Impact: 1.4

Affected Packages4 packages

▶debiandebian/phpmyadmin< phpmyadmin 4:4.6.3-1 (bookworm)

▶Packagistphpmyadmin/phpmyadmin4.6.0 — 4.6.3

▶Debianphpmyadmin/phpmyadmin< 4:4.6.3-1+3

▶NVDphpmyadmin/phpmyadmin4.6.0, 4.6.1, 4.6.2+2

Patches

Patch: github.com ↗Patch: www.phpmyadmin.net ↗Patch: github.com ↗

🔴Vulnerability Details

GHSA

phpMyAdmin cookie-attribute injection↗2022-05-17

▶

OSV

phpMyAdmin cookie-attribute injection↗2022-05-17

▶

OSV

CVE-2016-5702: phpMyAdmin 4↗2016-07-03

▶

📋Vendor Advisories

Debian

CVE-2016-5702: phpmyadmin - phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHP_SELF value, allo...↗2016

▶

💬Community

Bugzilla

CVE-2016-5701 CVE-2016-5702 CVE-2016-5703 CVE-2016-5704 CVE-2016-5705 CVE-2016-5706 CVE-2016-5730 CVE-2016-5731 CVE-2016-5732 CVE-2016-5733 CVE-2016-5734 CVE-2016-5739 phpMyAdmin: 4.6.3, 4.4.15.7 and ↗2016-06-23

▶

Bugzilla

▶

Bugzilla

▶

Bugzilla

▶