Tenable9116.PRMphpMyAdmin 4.4.x < 4.4.15.3 / 4.5.x < 4.5.4 Multiple Vulnerabilities (PMASA-2016-6, PMASA-2016-7)
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
0.005 Low
EPSS
Percentile
77.3%
Versions of phpMyAdmin 4.4.x prior to 4.4.15.3, or 4.5.x prior to 4.5.4 are unpatched for the following vulnerabilities :
- An information disclosure vulnerability exists in the ‘AES.php’ and ‘Rijndael.php’ scripts that allows a remote attacker, via a specially crafted request, to disclose the software’s installation path. (CVE-2016-2042)
- A cross-site scripting vulnerability exists due to improper validation of user-supplied input to the normalization script when handling a crafted table name before returning it to users. An authenticated, remote attacker can exploit this, via specially crafted request, to execute arbitrary script code in a user’s browser session. (CVE-2016-2043)
Binary data 9116.prm| Vendor | Product | Version | CPE |
|---|---|---|---|
| phpmyadmin | phpmyadmin | cpe:/a:phpmyadmin:phpmyadmin |
Related
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
0.005 Low
EPSS
Percentile
77.3%