CVE-2016-9848: Infoleak

Published Dec 11, 2016

Updated

An issue was discovered in phpMyAdmin. phpinfo (phpinfo.php) shows PHP information including values of HttpOnly cookies. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.

Affected Software

63 affected components

phpMyAdmin phpMyAdmin=4.4.0

phpMyAdmin phpMyAdmin=4.4.1

phpMyAdmin phpMyAdmin=4.4.1.1

phpMyAdmin phpMyAdmin=4.4.2

phpMyAdmin phpMyAdmin=4.4.3

phpMyAdmin phpMyAdmin=4.4.4

phpMyAdmin phpMyAdmin=4.4.5

phpMyAdmin phpMyAdmin=4.4.6

phpMyAdmin phpMyAdmin=4.4.6.1

phpMyAdmin phpMyAdmin=4.4.7

phpMyAdmin phpMyAdmin=4.4.8

phpMyAdmin phpMyAdmin=4.4.9

phpMyAdmin phpMyAdmin=4.4.10

phpMyAdmin phpMyAdmin=4.4.11

phpMyAdmin phpMyAdmin=4.4.12

phpMyAdmin phpMyAdmin=4.4.13

phpMyAdmin phpMyAdmin=4.4.13.1

phpMyAdmin phpMyAdmin=4.4.14

phpMyAdmin phpMyAdmin=4.4.14.1

phpMyAdmin phpMyAdmin=4.4.15

phpMyAdmin phpMyAdmin=4.4.15.1

phpMyAdmin phpMyAdmin=4.4.15.2

phpMyAdmin phpMyAdmin=4.4.15.3

phpMyAdmin phpMyAdmin=4.4.15.4

phpMyAdmin phpMyAdmin=4.4.15.5

phpMyAdmin phpMyAdmin=4.4.15.6

phpMyAdmin phpMyAdmin=4.4.15.7

phpMyAdmin phpMyAdmin=4.4.15.8

phpMyAdmin phpMyAdmin=4.6.0

phpMyAdmin phpMyAdmin=4.6.1

phpMyAdmin phpMyAdmin=4.6.2

phpMyAdmin phpMyAdmin=4.6.3

phpMyAdmin phpMyAdmin=4.6.4

phpMyAdmin phpMyAdmin=4.0.0

phpMyAdmin phpMyAdmin=4.0.1

phpMyAdmin phpMyAdmin=4.0.2

phpMyAdmin phpMyAdmin=4.0.3

phpMyAdmin phpMyAdmin=4.0.4

phpMyAdmin phpMyAdmin=4.0.4.1

phpMyAdmin phpMyAdmin=4.0.4.2

phpMyAdmin phpMyAdmin=4.0.5

phpMyAdmin phpMyAdmin=4.0.6

phpMyAdmin phpMyAdmin=4.0.7

phpMyAdmin phpMyAdmin=4.0.8

phpMyAdmin phpMyAdmin=4.0.9

phpMyAdmin phpMyAdmin=4.0.10

phpMyAdmin phpMyAdmin=4.0.10.1

phpMyAdmin phpMyAdmin=4.0.10.2

phpMyAdmin phpMyAdmin=4.0.10.3

phpMyAdmin phpMyAdmin=4.0.10.4

phpMyAdmin phpMyAdmin=4.0.10.5

phpMyAdmin phpMyAdmin=4.0.10.6

phpMyAdmin phpMyAdmin=4.0.10.7

phpMyAdmin phpMyAdmin=4.0.10.8

phpMyAdmin phpMyAdmin=4.0.10.9

phpMyAdmin phpMyAdmin=4.0.10.10

phpMyAdmin phpMyAdmin=4.0.10.11

phpMyAdmin phpMyAdmin=4.0.10.12

phpMyAdmin phpMyAdmin=4.0.10.13

phpMyAdmin phpMyAdmin=4.0.10.14

phpMyAdmin phpMyAdmin=4.0.10.15

phpMyAdmin phpMyAdmin=4.0.10.16

phpMyAdmin phpMyAdmin=4.0.10.17

Remediation

Patch Available

https://www.phpmyadmin.net/security/PMASA-2016-59

Event History

Dec 11, 2016

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-9848?

CVE-2016-9848 has been classified as a medium severity vulnerability.

How do I fix CVE-2016-9848?

To fix CVE-2016-9848, upgrade to phpMyAdmin version 4.6.5 or later, or 4.4.15.9 or later, or 4.0.10.18 or later.

Which phpMyAdmin versions are affected by CVE-2016-9848?

phpMyAdmin versions prior to 4.6.5 for 4.6.x series, 4.4.15.9 for 4.4.x series, and 4.0.10.18 for 4.0.x series are affected by CVE-2016-9848.

What type of information does CVE-2016-9848 leak?

CVE-2016-9848 can leak sensitive information by exposing values of HttpOnly cookies through phpinfo.

Is there a workaround for CVE-2016-9848 if I cannot upgrade?

There are no specific workarounds for CVE-2016-9848; upgrading to a patched version is the recommended solution.