Cookie attribute injection attack

PMASA-2016-18

Announcement-ID: PMASA-2016-18

Date: 2016-06-23

Summary

Cookie attribute injection attack

Description

A vulnerability was found where, under some circumstances, an attacker can inject arbitrary values in the browser cookies.

Severity

We consider this to be non-critical.

Mitigation factor

Properly configured server which sets PHP_SELF is not affected by this.

Affected Versions

All 4.6.x versions (prior to 4.6.3) are affected

Solution

Upgrade to phpMyAdmin 4.6.3 or newer or apply patch listed below.

References

Thanks to Emanuel Bronshtein @e3amn2l for reporting these vulnerabilities.

Assigned CVE ids: CVE-2016-5702

CWE ids: CWE-661

Patches

The following commits have been made on the 4.6 branch to fix this issue:

• 27caf5b46bd0890e576fea7bd7b166a0639fdf68

More information

For further information and in case of questions, please contact the phpMyAdmin team. Our website is phpmyadmin.net.