CVE-2016-9851: Medium severity phpmyadmin vulnerability
Published Dec 11, 2016
·Updated
An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to bypass the logout timeout. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected.
Affected Software
35 affected componentsFixes available
composer/phpmyadmin/phpmyadmin>=4.4<4.4.15.9
4.4.15.9
composer/phpmyadmin/phpmyadmin>=4.6<4.6.5
4.6.5
phpMyAdmin phpMyAdmin=4.4.0
phpMyAdmin phpMyAdmin=4.4.1
phpMyAdmin phpMyAdmin=4.4.1.1
phpMyAdmin phpMyAdmin=4.4.2
phpMyAdmin phpMyAdmin=4.4.3
phpMyAdmin phpMyAdmin=4.4.4
phpMyAdmin phpMyAdmin=4.4.5
phpMyAdmin phpMyAdmin=4.4.6
phpMyAdmin phpMyAdmin=4.4.6.1
phpMyAdmin phpMyAdmin=4.4.7
phpMyAdmin phpMyAdmin=4.4.8
phpMyAdmin phpMyAdmin=4.4.9
phpMyAdmin phpMyAdmin=4.4.10
phpMyAdmin phpMyAdmin=4.4.11
phpMyAdmin phpMyAdmin=4.4.12
phpMyAdmin phpMyAdmin=4.4.13
phpMyAdmin phpMyAdmin=4.4.13.1
phpMyAdmin phpMyAdmin=4.4.14
phpMyAdmin phpMyAdmin=4.4.14.1
phpMyAdmin phpMyAdmin=4.4.15
phpMyAdmin phpMyAdmin=4.4.15.1
phpMyAdmin phpMyAdmin=4.4.15.2
phpMyAdmin phpMyAdmin=4.4.15.3
phpMyAdmin phpMyAdmin=4.4.15.4
phpMyAdmin phpMyAdmin=4.4.15.5
phpMyAdmin phpMyAdmin=4.4.15.6
phpMyAdmin phpMyAdmin=4.4.15.7
phpMyAdmin phpMyAdmin=4.4.15.8
phpMyAdmin phpMyAdmin=4.6.0
phpMyAdmin phpMyAdmin=4.6.1
phpMyAdmin phpMyAdmin=4.6.2
phpMyAdmin phpMyAdmin=4.6.3
phpMyAdmin phpMyAdmin=4.6.4
Remediation
Patch Available
Event History
Dec 11, 2016
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
May 17, 2022
Advisory Published
via GitHub·02:36 AM
Frequently Asked Questions
1
What is the severity of CVE-2016-9851?
CVE-2016-9851 has a medium severity level as it allows users to bypass logout timeouts.
2
How do I fix CVE-2016-9851?
To remediate CVE-2016-9851, upgrade phpMyAdmin to version 4.4.15.9 or 4.6.5 and above.
3
What versions of phpMyAdmin are affected by CVE-2016-9851?
CVE-2016-9851 affects phpMyAdmin versions prior to 4.4.15.9 and 4.6.5.
4
Can I mitigate CVE-2016-9851 without upgrading?
There is no direct mitigation for CVE-2016-9851 other than applying the recommended software update.
5
What type of vulnerability is CVE-2016-9851?
CVE-2016-9851 is a vulnerability related to session management, specifically allowing logout timeout bypass.