CVE-2016-9851

An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to bypass the logout timeout. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/94534	Third Party Advisory VDB Entry
https://security.gentoo.org/glsa/201701-32
https://www.phpmyadmin.net/security/PMASA-2016-62	Patch Vendor Advisory
http://www.securityfocus.com/bid/94534	Third Party Advisory VDB Entry
https://security.gentoo.org/glsa/201701-32
https://www.phpmyadmin.net/security/PMASA-2016-62	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:::::::*

Configuration 2 (hide)

OR	cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:::::::*
	cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:::::::*

History

21 Nov 2024, 03:01

Type	Values Removed	Values Added
References	~~() http://www.securityfocus.com/bid/94534 - Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/94534 - Third Party Advisory, VDB Entry
References	~~() https://security.gentoo.org/glsa/201701-32 -~~	() https://security.gentoo.org/glsa/201701-32 -
References	~~() https://www.phpmyadmin.net/security/PMASA-2016-62 - Patch, Vendor Advisory~~	() https://www.phpmyadmin.net/security/PMASA-2016-62 - Patch, Vendor Advisory

Information

Published : 2016-12-11 02:59

Updated : 2025-04-12 10:46

NVD link : CVE-2016-9851

Mitre link : CVE-2016-9851

CVE.ORG link : CVE-2016-9851

JSON object : View

Products Affected

phpmyadmin

phpmyadmin

CWE

CWE-254

7PK - Security Features

{"id": "CVE-2016-9851", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2016-12-11T02:59:49.193", "references": [{"url": "http://www.securityfocus.com/bid/94534", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://security.gentoo.org/glsa/201701-32", "source": "cve@mitre.org"}, {"url": "https://www.phpmyadmin.net/security/PMASA-2016-62", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/94534", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.gentoo.org/glsa/201701-32", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.phpmyadmin.net/security/PMASA-2016-62", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-254"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to bypass the logout timeout. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en phpMyAdmin. Con un valor de par\u00e1metro de solicitud manipulado es posible eludir el tiempo de espera de cierre de sesi\u00f3n. Todas las versiones 4.6.x (anteriores a 4.6.5) y versiones 4.4.x (anteriores a 4.4.15.9) est\u00e1n afectadas."}], "lastModified": "2025-04-12T10:46:40.837", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "74C191A5-3316-4A34-8B37-64D6DD616CEF"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392"}, {"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}

5.3 /10

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.0 /10

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

JSON object

Attach tags to CVE-2016-9851

5.3^/10

5.0^/10

Attach tags to `CVE-2016-9851`