7.5

CVE-2016-2041

libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fedoraproject ≫ Fedora Version 22
Fedoraproject ≫ Fedora Version 23
Phpmyadmin ≫ Phpmyadmin Version 4.0.0
Phpmyadmin ≫ Phpmyadmin Version 4.0.0 Update rc2
Phpmyadmin ≫ Phpmyadmin Version 4.0.0 Update rc3
Phpmyadmin ≫ Phpmyadmin Version 4.0.1
Phpmyadmin ≫ Phpmyadmin Version 4.0.10
Phpmyadmin ≫ Phpmyadmin Version 4.0.10.1
Phpmyadmin ≫ Phpmyadmin Version 4.0.10.2
Phpmyadmin ≫ Phpmyadmin Version 4.0.10.3
Phpmyadmin ≫ Phpmyadmin Version 4.0.10.4
Phpmyadmin ≫ Phpmyadmin Version 4.0.10.5
Phpmyadmin ≫ Phpmyadmin Version 4.0.10.6
Phpmyadmin ≫ Phpmyadmin Version 4.0.10.7
Phpmyadmin ≫ Phpmyadmin Version 4.0.10.8
Phpmyadmin ≫ Phpmyadmin Version 4.0.10.9
Phpmyadmin ≫ Phpmyadmin Version 4.0.10.10
Phpmyadmin ≫ Phpmyadmin Version 4.0.10.11
Phpmyadmin ≫ Phpmyadmin Version 4.0.10.12
Phpmyadmin ≫ Phpmyadmin Version 4.4.0
Phpmyadmin ≫ Phpmyadmin Version 4.4.1
Phpmyadmin ≫ Phpmyadmin Version 4.4.1.1
Phpmyadmin ≫ Phpmyadmin Version 4.4.2
Phpmyadmin ≫ Phpmyadmin Version 4.4.3
Phpmyadmin ≫ Phpmyadmin Version 4.4.4
Phpmyadmin ≫ Phpmyadmin Version 4.4.5
Phpmyadmin ≫ Phpmyadmin Version 4.4.6
Phpmyadmin ≫ Phpmyadmin Version 4.4.6.1
Phpmyadmin ≫ Phpmyadmin Version 4.4.7
Phpmyadmin ≫ Phpmyadmin Version 4.4.8
Phpmyadmin ≫ Phpmyadmin Version 4.4.9
Phpmyadmin ≫ Phpmyadmin Version 4.4.10
Phpmyadmin ≫ Phpmyadmin Version 4.4.11
Phpmyadmin ≫ Phpmyadmin Version 4.4.12
Phpmyadmin ≫ Phpmyadmin Version 4.4.13
Phpmyadmin ≫ Phpmyadmin Version 4.4.13.1
Phpmyadmin ≫ Phpmyadmin Version 4.4.14.1
Phpmyadmin ≫ Phpmyadmin Version 4.4.15
Phpmyadmin ≫ Phpmyadmin Version 4.4.15.1
Phpmyadmin ≫ Phpmyadmin Version 4.4.15.2
Phpmyadmin ≫ Phpmyadmin Version 4.4.15.3
Phpmyadmin ≫ Phpmyadmin Version 4.5.0
Phpmyadmin ≫ Phpmyadmin Version 4.5.0.1
Phpmyadmin ≫ Phpmyadmin Version 4.5.0.2
Phpmyadmin ≫ Phpmyadmin Version 4.5.1
Phpmyadmin ≫ Phpmyadmin Version 4.5.2
Phpmyadmin ≫ Phpmyadmin Version 4.5.3
Opensuse ≫ Leap Version 42.1
Opensuse ≫ Opensuse Version 13.1
Opensuse ≫ Opensuse Version 13.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.65% 0.836
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:P/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html
Third Party Advisory
http://www.debian.org/security/2016/dsa-3627
http://www.phpmyadmin.net/home_page/security/PMASA-2016-5.php
Patch
Vendor Advisory
https://github.com/phpmyadmin/phpmyadmin/commit/ec0e88e37ef30a66eada1c072953f4ec385a3e49
Patch