CVE-2016-9866 — Cross-Site Request Forgery in Phpmyadmin

CWE-352 — Cross-Site Request Forgery8 documents6 sources
Severity
9.8CRITICALNVD
OSV5.0
EPSS
0.2%
top 55.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
PhpmyadminDebian Phpmyadmin
Timeline
PublishedDec 11
Latest updateMay 17

Description

An issue was discovered in phpMyAdmin. When the arg_separator is different from its default & value, the CSRF token was not properly stripped from the return URL of the preference import action. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages5 packages

▶debiandebian/phpmyadmin< phpmyadmin 4:4.6.5.1-1 (bookworm)
▶Packagistphpmyadmin/phpmyadmin4.6.0 — 4.6.5+2
▶Debianphpmyadmin/phpmyadmin< 4:4.6.5.1-1+3
▶Ubuntuphpmyadmin/phpmyadmin< 4:4.0.10-1ubuntu0.1+esm4+3
▶NVDphpmyadmin/phpmyadmin63 versions+62

Patches

Patch: www.phpmyadmin.net ↗Patch: www.phpmyadmin.net ↗

🔴Vulnerability Details

4
OSV
phpMyAdmin CSRF Vulnerability↗2022-05-17
▶
GHSA
phpMyAdmin CSRF Vulnerability↗2022-05-17
▶
OSV
phpmyadmin vulnerabilities↗2021-03-16
▶
OSV
CVE-2016-9866: An issue was discovered in phpMyAdmin↗2016-12-11
▶

📋Vendor Advisories

2
Ubuntu
phpMyAdmin vulnerabilities↗2021-03-16
▶
Debian
CVE-2016-9866: phpmyadmin - An issue was discovered in phpMyAdmin. When the arg_separator is different from ...↗2016
▶