CVE-2016-5097
Published: 5 July 2016
phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers to obtain sensitive information by reading (1) HTTP requests or (2) server logs.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
phpmyadmin Launchpad, Ubuntu, Debian |
artful |
Not vulnerable
(4:4.6.2-1)
|
| bionic |
Not vulnerable
(4:4.6.2-1)
|
|
| cosmic |
Not vulnerable
(4:4.6.2-1)
|
|
| disco |
Not vulnerable
(4:4.6.2-1)
|
|
| eoan |
Does not exist
|
|
| focal |
Not vulnerable
(4:4.6.2-1)
|
|
| groovy |
Not vulnerable
(4:4.6.2-1)
|
|
| hirsute |
Not vulnerable
(4:4.6.2-1)
|
|
| impish |
Not vulnerable
(4:4.6.2-1)
|
|
| jammy |
Not vulnerable
(4:4.6.2-1)
|
|
| kinetic |
Not vulnerable
(4:4.6.2-1)
|
|
| lunar |
Not vulnerable
(4:4.6.2-1)
|
|
| mantic |
Not vulnerable
(4:4.6.2-1)
|
|
| noble |
Not vulnerable
(4:4.6.2-1)
|
|
| precise |
Ignored
(end of life)
|
|
| trusty |
Needed
|
|
| upstream |
Released
(4:4.6.2-1)
|
|
| wily |
Ignored
(end of life)
|
|
| xenial |
Needed
|
|
| yakkety |
Not vulnerable
(4:4.6.2-1)
|
|
| zesty |
Not vulnerable
(4:4.6.2-1)
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 5.3 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | Low |
| Integrity impact | None |
| Availability impact | None |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |