CVE-2016-5099: XSS
First published: Tue Jul 05 2016(Updated: )
Cross-site scripting (XSS) vulnerability in phpMyAdmin 4.4.x before 4.4.15.6 and 4.6.x before 4.6.2 allows remote attackers to inject arbitrary web script or HTML via special characters that are mishandled during double URL decoding.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| phpMyAdmin | =4.4.0 | |
| phpMyAdmin | =4.4.1 | |
| phpMyAdmin | =4.4.1.1 | |
| phpMyAdmin | =4.4.2 | |
| phpMyAdmin | =4.4.3 | |
| phpMyAdmin | =4.4.4 | |
| phpMyAdmin | =4.4.5 | |
| phpMyAdmin | =4.4.6 | |
| phpMyAdmin | =4.4.6.1 | |
| phpMyAdmin | =4.4.7 | |
| phpMyAdmin | =4.4.8 | |
| phpMyAdmin | =4.4.9 | |
| phpMyAdmin | =4.4.10 | |
| phpMyAdmin | =4.4.11 | |
| phpMyAdmin | =4.4.12 | |
| phpMyAdmin | =4.4.13 | |
| phpMyAdmin | =4.4.13.1 | |
| phpMyAdmin | =4.4.14.1 | |
| phpMyAdmin | =4.4.15 | |
| phpMyAdmin | =4.4.15.1 | |
| phpMyAdmin | =4.4.15.2 | |
| phpMyAdmin | =4.4.15.3 | |
| phpMyAdmin | =4.4.15.4 | |
| phpMyAdmin | =4.4.15.5 | |
| SUSE Linux | =13.1 | |
| phpMyAdmin | =4.6.0 | |
| phpMyAdmin | =4.6.0-alpha1 | |
| phpMyAdmin | =4.6.0-rc1 | |
| phpMyAdmin | =4.6.0-rc2 | |
| phpMyAdmin | =4.6.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html
- http://www.debian.org/security/2016/dsa-3627
- http://www.securityfocus.com/bid/90877
- http://www.securitytracker.com/id/1035979
- https://github.com/phpmyadmin/phpmyadmin/commit/b061096abd992801fbbd805ef6ff74e627528780
- https://security.gentoo.org/glsa/201701-32
- https://www.phpmyadmin.net/security/PMASA-2016-16
Frequently Asked Questions
What is the severity of CVE-2016-5099?
CVE-2016-5099 has a moderate severity rating due to its potential for cross-site scripting attacks.
How do I fix CVE-2016-5099?
To fix CVE-2016-5099, upgrade phpMyAdmin to version 4.4.15.6 or later, or 4.6.2 or later.
What systems are affected by CVE-2016-5099?
CVE-2016-5099 affects phpMyAdmin versions 4.4.0 to 4.4.15.5 and 4.6.0 to 4.6.1.
What type of vulnerability is CVE-2016-5099?
CVE-2016-5099 is a cross-site scripting (XSS) vulnerability.
Can CVE-2016-5099 be exploited remotely?
Yes, CVE-2016-5099 can be exploited remotely by attackers to inject arbitrary web scripts or HTML.
- agent/type
- agent/remedy
- agent/references
- agent/severity
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/weakness
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/phpmyadmin
- canonical/phpmyadmin
- version/phpmyadmin/4.4.0
- version/phpmyadmin/4.4.1
- version/phpmyadmin/4.4.1.1
- version/phpmyadmin/4.4.2
- version/phpmyadmin/4.4.3
- version/phpmyadmin/4.4.4
- version/phpmyadmin/4.4.5
- version/phpmyadmin/4.4.6
- version/phpmyadmin/4.4.6.1
- version/phpmyadmin/4.4.7
- version/phpmyadmin/4.4.8
- version/phpmyadmin/4.4.9
- version/phpmyadmin/4.4.10
- version/phpmyadmin/4.4.11
- version/phpmyadmin/4.4.12
- version/phpmyadmin/4.4.13
- version/phpmyadmin/4.4.13.1
- version/phpmyadmin/4.4.14.1
- version/phpmyadmin/4.4.15
- version/phpmyadmin/4.4.15.1
- version/phpmyadmin/4.4.15.2
- version/phpmyadmin/4.4.15.3
- version/phpmyadmin/4.4.15.4
- version/phpmyadmin/4.4.15.5
- vendor/opensuse
- canonical/suse linux
- version/suse linux/13.1
- version/phpmyadmin/4.6.0
- version/phpmyadmin/4.6.0-alpha1
- version/phpmyadmin/4.6.0-rc1
- version/phpmyadmin/4.6.0-rc2
- version/phpmyadmin/4.6.1