Description

phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers to obtain sensitive information by reading (1) HTTP requests or (2) server logs.

Remediation

References

CVE-2016-5097

Related Vulnerabilities

Jenkins Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2015-5318)

WordPress Plugin BuddyPress Extended Friendship Request Cross-Site Scripting (1.0.1)

OpenSSL Numeric Errors Vulnerability (CVE-2008-0891)

Apache Tomcat Improper Authentication Vulnerability (CVE-2013-2067)

phpMyAdmin Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2008-4775)

Severity

Medium

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities CWE-200 CVE-2016-5097