Lucene search

K
nvd[email protected]NVD:CVE-2016-9856
HistoryDec 11, 2016 - 2:59 a.m.

CVE-2016-9856

2016-12-1102:59:55
CWE-79
web.nvd.nist.gov
7
phpmyadmin
xss
improper fix
cve-2016-2559

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

48.3%

An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. This issue is resolved by using a copy of a hash to avoid a race condition. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.

Affected configurations

Nvd
Node
phpmyadminphpmyadminMatch4.0.0
OR
phpmyadminphpmyadminMatch4.0.1
OR
phpmyadminphpmyadminMatch4.0.2
OR
phpmyadminphpmyadminMatch4.0.3
OR
phpmyadminphpmyadminMatch4.0.4
OR
phpmyadminphpmyadminMatch4.0.4.1
OR
phpmyadminphpmyadminMatch4.0.4.2
OR
phpmyadminphpmyadminMatch4.0.5
OR
phpmyadminphpmyadminMatch4.0.6
OR
phpmyadminphpmyadminMatch4.0.7
OR
phpmyadminphpmyadminMatch4.0.8
OR
phpmyadminphpmyadminMatch4.0.9
OR
phpmyadminphpmyadminMatch4.0.10
OR
phpmyadminphpmyadminMatch4.0.10.1
OR
phpmyadminphpmyadminMatch4.0.10.2
OR
phpmyadminphpmyadminMatch4.0.10.3
OR
phpmyadminphpmyadminMatch4.0.10.4
OR
phpmyadminphpmyadminMatch4.0.10.5
OR
phpmyadminphpmyadminMatch4.0.10.6
OR
phpmyadminphpmyadminMatch4.0.10.7
OR
phpmyadminphpmyadminMatch4.0.10.8
OR
phpmyadminphpmyadminMatch4.0.10.9
OR
phpmyadminphpmyadminMatch4.0.10.10
OR
phpmyadminphpmyadminMatch4.0.10.11
OR
phpmyadminphpmyadminMatch4.0.10.12
OR
phpmyadminphpmyadminMatch4.0.10.13
OR
phpmyadminphpmyadminMatch4.0.10.14
OR
phpmyadminphpmyadminMatch4.0.10.15
OR
phpmyadminphpmyadminMatch4.0.10.16
OR
phpmyadminphpmyadminMatch4.0.10.17
Node
phpmyadminphpmyadminMatch4.6.0
OR
phpmyadminphpmyadminMatch4.6.1
OR
phpmyadminphpmyadminMatch4.6.2
OR
phpmyadminphpmyadminMatch4.6.3
OR
phpmyadminphpmyadminMatch4.6.4
Node
phpmyadminphpmyadminMatch4.4.0
OR
phpmyadminphpmyadminMatch4.4.1
OR
phpmyadminphpmyadminMatch4.4.1.1
OR
phpmyadminphpmyadminMatch4.4.2
OR
phpmyadminphpmyadminMatch4.4.3
OR
phpmyadminphpmyadminMatch4.4.4
OR
phpmyadminphpmyadminMatch4.4.5
OR
phpmyadminphpmyadminMatch4.4.6
OR
phpmyadminphpmyadminMatch4.4.6.1
OR
phpmyadminphpmyadminMatch4.4.7
OR
phpmyadminphpmyadminMatch4.4.8
OR
phpmyadminphpmyadminMatch4.4.9
OR
phpmyadminphpmyadminMatch4.4.10
OR
phpmyadminphpmyadminMatch4.4.11
OR
phpmyadminphpmyadminMatch4.4.12
OR
phpmyadminphpmyadminMatch4.4.13
OR
phpmyadminphpmyadminMatch4.4.13.1
OR
phpmyadminphpmyadminMatch4.4.14
OR
phpmyadminphpmyadminMatch4.4.14.1
OR
phpmyadminphpmyadminMatch4.4.15
OR
phpmyadminphpmyadminMatch4.4.15.1
OR
phpmyadminphpmyadminMatch4.4.15.2
OR
phpmyadminphpmyadminMatch4.4.15.3
OR
phpmyadminphpmyadminMatch4.4.15.4
OR
phpmyadminphpmyadminMatch4.4.15.5
OR
phpmyadminphpmyadminMatch4.4.15.6
OR
phpmyadminphpmyadminMatch4.4.15.7
OR
phpmyadminphpmyadminMatch4.4.15.8
VendorProductVersionCPE
phpmyadminphpmyadmin4.0.0cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*
phpmyadminphpmyadmin4.0.1cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*
phpmyadminphpmyadmin4.0.2cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*
phpmyadminphpmyadmin4.0.3cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*
phpmyadminphpmyadmin4.0.4cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*
phpmyadminphpmyadmin4.0.4.1cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*
phpmyadminphpmyadmin4.0.4.2cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*
phpmyadminphpmyadmin4.0.5cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*
phpmyadminphpmyadmin4.0.6cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*
phpmyadminphpmyadmin4.0.7cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*
Rows per page:
1-10 of 631

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

48.3%