CVE-2016-6624 — Phpmyadmin vulnerability

CWE-2545 documents4 sources
Severity
5.9MEDIUMNVD
EPSS
0.3%
top 46.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
PhpmyadminDebian Phpmyadmin
Timeline
PublishedDec 11
Latest updateMay 17

Description

An issue was discovered in phpMyAdmin involving improper enforcement of the IP-based authentication rules. When phpMyAdmin is used with IPv6 in a proxy server environment, and the proxy server is in the allowed range but the attacking computer is not allowed, this vulnerability can allow the attacking computer to connect despite the IP rules. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages4 packages

▶debiandebian/phpmyadmin< phpmyadmin 4:4.6.4+dfsg1-1 (bookworm)
▶Packagistphpmyadmin/phpmyadmin4.6 — 4.6.4+2
▶Debianphpmyadmin/phpmyadmin< 4:4.6.4+dfsg1-1+3
▶NVDphpmyadmin/phpmyadmin60 versions+59

Patches

Patch: www.phpmyadmin.net ↗Patch: www.phpmyadmin.net ↗

🔴Vulnerability Details

3
GHSA
phpMyAdmin IPv6 and proxy server IP-based authentication rule circumvention↗2022-05-17
▶
OSV
phpMyAdmin IPv6 and proxy server IP-based authentication rule circumvention↗2022-05-17
▶
OSV
CVE-2016-6624: An issue was discovered in phpMyAdmin involving improper enforcement of the IP-based authentication rules↗2016-12-11
▶

📋Vendor Advisories

1
Debian
CVE-2016-6624: phpmyadmin - An issue was discovered in phpMyAdmin involving improper enforcement of the IP-b...↗2016
▶