Description

libraries/session.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not properly generate CSRF token values, which allows remote attackers to bypass intended access restrictions by predicting a value.

Remediation

References

CVE-2016-2039

Related Vulnerabilities

WordPress Plugin WP Keyword Link Multiple Cross-Site Scripting Vulnerabilities (1.7)

WordPress Plugin Uncanny Toolkit for LearnDash Cross-Site Request Forgery (3.6.3)

Atlassian Jira Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-13387)

WordPress Plugin Airtight Security & Features Formerly Redirect Editor And Security Unspecified Vulnerability (2.1.7)

WordPress Plugin TRADIES Information Disclosure (2.2.6)

Severity

Medium

Classification

CVE-2016-2039 CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities