CVE-2016-9866

CRITICAL9.8EPSS 0.22%

phpMyAdmin CSRF Vulnerability

發布日:2022/5/17修改日:2025/11/19

也稱為:GHSA-jvxx-8xxf-5495ALPINE-CVE-2016-9866DEBIAN-CVE-2016-9866

描述

An issue was discovered in phpMyAdmin. When the arg_separator is different from its default & value, the CSRF token was not properly stripped from the return URL of the preference import action. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.

受影響套件(3)

Alpine/phpmyadminfrom 0, < 4.4.15.9-r0
Debian/phpmyadminfrom 0, < 4:4.6.5.1-1
Packagist/phpmyadmin/phpmyadmin>= 4.6.0, < 4.6.5

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

參考連結(7)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2016-9866
ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2016-9866
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2016-9866
PATCHhttps://github.com/phpmyadmin/composer
WEBhttps://security.gentoo.org/glsa/201701-32
WEBhttps://web.archive.org/web/20210123194736/http://www.securityfocus.com/bid/94536
WEBhttps://www.phpmyadmin.net/security/PMASA-2016-71