Skip to content
OpenAdvisories
High · 7.5 CVE-2016-2041 EUVD-2022-3200GHSA-8m97-xc46-rw9w

phpMyAdmin Unsafe comparison of XSRF/CSRF token

Published Feb 20, 2016 · Updated Aug 5, 2024 · Assigned by mitre

Package: phpmyadmin Package: phpmyadmin Package: phpmyadmin/phpmyadmin Ecosystem: Debian Ecosystem: Packagist Ecosystem: Ubuntu

Description

libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 phpmyadmin 4:4.5.4-1 —
Debian 13 phpmyadmin 4:4.5.4-1 —
Debian 12 phpmyadmin 4:4.5.4-1 —
Debian 8 phpmyadmin 4:4.2.12-2+deb8u2 DSA-3627-1
Debian 7 phpmyadmin 4:3.4.11.1-2+deb7u3 DLA-481-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Debian 6.0 phpmyadmin 4:3.3.7-11 DLA-406-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 14.04 LTS phpmyadmin No fix yet —

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed phpMyAdmin 4.6.5.2-1.1 openSUSE-SU-2024:10054-1

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist phpmyadmin/phpmyadmin >= 4.0, < 4.0.10.13 4.0.10.13 GHSA-8m97-xc46-rw9w
Packagist phpmyadmin/phpmyadmin >= 4.4, < 4.4.15.3 4.4.15.3 GHSA-8m97-xc46-rw9w
Packagist phpmyadmin/phpmyadmin >= 4.5, < 4.5.4 4.5.4 GHSA-8m97-xc46-rw9w

Advisories 4

References