CVE-2016-5097: Infoleak
Published Jul 5, 2016
·Updated
phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers to obtain sensitive information by reading (1) HTTP requests or (2) server logs.
Affected Software
2 affected components
openSUSE openSUSE=13.1
phpMyAdmin phpMyAdmin<=4.6.1
Remediation
Patch Available
Event History
Jul 5, 2016
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-5097?
CVE-2016-5097 is classified as a moderate severity vulnerability.
2
How do I fix CVE-2016-5097?
To fix CVE-2016-5097, you should upgrade phpMyAdmin to version 4.6.2 or later.
3
What types of sensitive information can be exposed due to CVE-2016-5097?
CVE-2016-5097 can expose sensitive information contained in HTTP requests and server logs.
4
Which versions of phpMyAdmin are affected by CVE-2016-5097?
CVE-2016-5097 affects all versions of phpMyAdmin up to and including 4.6.1.
5
Is openSUSE version 13.1 vulnerable to CVE-2016-5097?
Yes, openSUSE version 13.1 is also vulnerable to CVE-2016-5097.