CVE-2016-9866 phpMyAdmin CSRF Vulnerability
CriticalCVSS 9.8
EPSS 1.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in phpMyAdmin. When the arg_separator is different from its default & value, the CSRF token was not properly stripped from the return URL of the preference import action. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phpmyadmin/phpmyadmin(Packagist) | >= 4.6.0, < 4.6.5 | 4.6.5 |
| phpmyadmin/phpmyadmin(Packagist) | >= 4.4.0, < 4.4.15.9 | 4.4.15.9 |
| phpmyadmin/phpmyadmin(Packagist) | >= 4.0.0, < 4.0.10.18 | 4.0.10.18 |
| phpmyadmin/phpmyadmin(Packagist) | = 4.0.0 | No fix listed |
| phpmyadmin/phpmyadmin(Packagist) | = 4.0.1 | No fix listed |
| phpmyadmin/phpmyadmin(Packagist) | = 4.0.10 | No fix listed |
| phpmyadmin/phpmyadmin(Packagist) | = 4.0.10.1 | No fix listed |
| phpmyadmin/phpmyadmin(Packagist) | = 4.0.10.2 | No fix listed |
| phpmyadmin/phpmyadmin(Packagist) | = 4.0.10.3 | No fix listed |
| phpmyadmin/phpmyadmin(Packagist) | = 4.0.10.4 | No fix listed |
| phpmyadmin/phpmyadmin(Packagist) | = 4.0.10.5 | No fix listed |
| phpmyadmin/phpmyadmin(Packagist) | = 4.0.10.6 | No fix listed |
| phpmyadmin/phpmyadmin(Packagist) | = 4.0.10.7 | No fix listed |
| phpmyadmin/phpmyadmin(Packagist) | = 4.0.10.8 | No fix listed |
| phpmyadmin/phpmyadmin(Packagist) | = 4.0.10.9 | No fix listed |
| phpmyadmin/phpmyadmin(Packagist) | = 4.0.2 | No fix listed |
| phpmyadmin/phpmyadmin(Packagist) | = 4.0.3 | No fix listed |
| phpmyadmin/phpmyadmin(Packagist) | = 4.0.4 | No fix listed |
| phpmyadmin/phpmyadmin(Packagist) | = 4.0.4.1 | No fix listed |
| phpmyadmin/phpmyadmin(Packagist) | = 4.0.4.2 | No fix listed |
| phpmyadmin/phpmyadmin(Packagist) | = 4.0.5 | No fix listed |
| phpmyadmin/phpmyadmin(Packagist) | = 4.0.6 | No fix listed |
| phpmyadmin/phpmyadmin(Packagist) | = 4.0.7 | No fix listed |
| phpmyadmin/phpmyadmin(Packagist) | = 4.0.8 | No fix listed |
| phpmyadmin/phpmyadmin(Packagist) | = 4.0.9 | No fix listed |
Show 88 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/phpmyadmin(Debian:12) | < 4:4.6.5.1-1 | 4:4.6.5.1-1 |
| debian/phpmyadmin(Debian:14) | < 4:4.6.5.1-1 | 4:4.6.5.1-1 |
| debian/phpmyadmin(Debian:13) | < 4:4.6.5.1-1 | 4:4.6.5.1-1 |
| phpmyadmin/phpmyadmin | = 4.6.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.6.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.6.2 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.6.3 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.6.4 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.1.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.2 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.3 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.4 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.5 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.6 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.6.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.7 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.8 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.9 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.10 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.11 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.12 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.13 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.13.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.14 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.14.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.15 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.15.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.15.2 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.15.3 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.15.4 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.15.5 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.15.6 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.15.7 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.15.8 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.2 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.3 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.4 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.4.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.4.2 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.5 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.6 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.7 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.8 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.9 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.10 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.10.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.10.2 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.10.3 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.10.4 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.10.5 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.10.6 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.10.7 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.10.8 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.10.9 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.10.10 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.10.11 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.10.12 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.10.13 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.10.14 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.10.15 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.10.16 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.0.10.17 | No fix listed |
| alpine/phpmyadmin(Alpine:v3.10) | < 4.6.5.2-r0 | 4.6.5.2-r0 |
| alpine/phpmyadmin(Alpine:v3.11) | < 4.6.5.2-r0 | 4.6.5.2-r0 |
| alpine/phpmyadmin(Alpine:v3.12) | < 4.6.5.2-r0 | 4.6.5.2-r0 |
| alpine/phpmyadmin(Alpine:v3.13) | < 4.6.5.2-r0 | 4.6.5.2-r0 |
| alpine/phpmyadmin(Alpine:v3.14) | < 4.6.5.2-r0 | 4.6.5.2-r0 |
| alpine/phpmyadmin(Alpine:v3.15) | < 4.6.5.2-r0 | 4.6.5.2-r0 |
| alpine/phpmyadmin(Alpine:v3.16) | < 4.6.5.2-r0 | 4.6.5.2-r0 |
| alpine/phpmyadmin(Alpine:v3.17) | < 4.6.5.2-r0 | 4.6.5.2-r0 |
| alpine/phpmyadmin(Alpine:v3.18) | < 4.6.5.2-r0 | 4.6.5.2-r0 |
| alpine/phpmyadmin(Alpine:v3.19) | < 4.6.5.2-r0 | 4.6.5.2-r0 |
| alpine/phpmyadmin(Alpine:v3.2) | < 4.4.15.9-r0 | 4.4.15.9-r0 |
| alpine/phpmyadmin(Alpine:v3.20) | < 4.6.5.2-r0 | 4.6.5.2-r0 |
| alpine/phpmyadmin(Alpine:v3.21) | < 4.6.5.2-r0 | 4.6.5.2-r0 |
| alpine/phpmyadmin(Alpine:v3.22) | < 4.6.5.2-r0 | 4.6.5.2-r0 |
| alpine/phpmyadmin(Alpine:v3.23) | < 4.6.5.2-r0 | 4.6.5.2-r0 |
| alpine/phpmyadmin(Alpine:v3.24) | < 4.6.5.2-r0 | 4.6.5.2-r0 |
| alpine/phpmyadmin(Alpine:v3.4) | < 4.6.5.2-r0 | 4.6.5.2-r0 |
| alpine/phpmyadmin(Alpine:v3.5) | < 4.6.5.2-r0 | 4.6.5.2-r0 |
| alpine/phpmyadmin(Alpine:v3.6) | < 4.6.5.2-r0 | 4.6.5.2-r0 |
| alpine/phpmyadmin(Alpine:v3.7) | < 4.6.5.2-r0 | 4.6.5.2-r0 |
| alpine/phpmyadmin(Alpine:v3.8) | < 4.6.5.2-r0 | 4.6.5.2-r0 |
| alpine/phpmyadmin(Alpine:v3.9) | < 4.6.5.2-r0 | 4.6.5.2-r0 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- GLSA-201701-32 vendor-advisory
- web.archive.org
- www.phpmyadmin.net patch vendor-advisory
- Debian Security Tracker CVE-2016-9866 vendor-advisory
- github.com
- 94536 vdb-entry
- security.alpinelinux.org vendor-advisory