CVE-2016-2041: phpMyAdmin Unsafe comparison of XSRF/CSRF token
libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences.
Other sources
phpMyAdmin Unsafe comparison of XSRF/CSRF token
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/phpmyadmin/phpmyadminto a version that resolves this vulnerability.Fixed in 4.5.4 - Upgrade
Upgrade
composer/phpmyadmin/phpmyadminto a version that resolves this vulnerability.Fixed in 4.4.15.3 - Upgrade
Upgrade
composer/phpmyadmin/phpmyadminto a version that resolves this vulnerability.Fixed in 4.0.10.13 - Upgrade
Upgrade
phpMyAdminto a version that resolves this vulnerability.Fixed in 4.0.10.13 - Upgrade
Upgrade
phpMyAdminto a version that resolves this vulnerability.Fixed in 4.4.15.3 - Upgrade
Upgrade
phpMyAdminto a version that resolves this vulnerability.Fixed in 4.5.4
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2041?
CVE-2016-2041 is considered a medium severity vulnerability due to its implications in allowing CSRF token comparison vulnerabilities.
How do I fix CVE-2016-2041?
To mitigate CVE-2016-2041, upgrade phpMyAdmin to version 4.5.4, 4.4.15.3, or 4.0.10.13 or newer.
Which versions of phpMyAdmin are affected by CVE-2016-2041?
CVE-2016-2041 affects phpMyAdmin versions before 4.0.10.13, before 4.4.15.3, and before 4.5.4.
What type of attack does CVE-2016-2041 represent?
CVE-2016-2041 represents a CSRF (Cross-Site Request Forgery) vulnerability that can enable bypassing intended access restrictions.
Can I find CVE-2016-2041 in any specific operating system packages?
Yes, CVE-2016-2041 is also associated with specific versions of Fedora and openSUSE packages that include vulnerable phpMyAdmin versions.