VulnerabilityModified

CVE-2016-5097

phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers to obtain sensitive information by reading (1) HTTP requests or (2) server logs.

MEDIUM 5.3EPSS 1.49%

Does this matter?

Lower severity and a low EPSS score (1.49%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 3.0: 5.3 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: 1.49% probability · 73th percentile
CISA KEV: Not listed
Weakness: CWE-200
Affected: opensuse/opensuse · phpmyadmin/phpmyadmin
Source: cve@mitre.org

References

http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html
http://www.securitytracker.com/id/1035978
https://github.com/phpmyadmin/phpmyadmin/commit/11eb574242d2526107366d367ab5585fbe29578fPatch
https://github.com/phpmyadmin/phpmyadmin/commit/59e56bd63a5e023b797d82eb272cd074e3b4bfd1Patch
https://github.com/phpmyadmin/phpmyadmin/commit/5fc8020c5ba9cd2e38beb5dfe013faf2103cdf0fPatch
https://github.com/phpmyadmin/phpmyadmin/commit/8326aaebe54083d9726e153abdd303a141fe5ad3Patch
https://security.gentoo.org/glsa/201701-32
https://www.phpmyadmin.net/security/PMASA-2016-14Patch, Vendor Advisory
http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html
http://www.securitytracker.com/id/1035978
https://github.com/phpmyadmin/phpmyadmin/commit/11eb574242d2526107366d367ab5585fbe29578fPatch
https://github.com/phpmyadmin/phpmyadmin/commit/59e56bd63a5e023b797d82eb272cd074e3b4bfd1Patch
https://github.com/phpmyadmin/phpmyadmin/commit/5fc8020c5ba9cd2e38beb5dfe013faf2103cdf0fPatch
https://github.com/phpmyadmin/phpmyadmin/commit/8326aaebe54083d9726e153abdd303a141fe5ad3Patch
https://security.gentoo.org/glsa/201701-32
https://www.phpmyadmin.net/security/PMASA-2016-14Patch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.