CVE-2016-9854: Infoleak
First published: Sun Dec 11 2016(Updated: )
An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the json_decode issue.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PhpMyAdmin | =4.4.0 | |
| PhpMyAdmin | =4.4.1 | |
| PhpMyAdmin | =4.4.1.1 | |
| PhpMyAdmin | =4.4.2 | |
| PhpMyAdmin | =4.4.3 | |
| PhpMyAdmin | =4.4.4 | |
| PhpMyAdmin | =4.4.5 | |
| PhpMyAdmin | =4.4.6 | |
| PhpMyAdmin | =4.4.6.1 | |
| PhpMyAdmin | =4.4.7 | |
| PhpMyAdmin | =4.4.8 | |
| PhpMyAdmin | =4.4.9 | |
| PhpMyAdmin | =4.4.10 | |
| PhpMyAdmin | =4.4.11 | |
| PhpMyAdmin | =4.4.12 | |
| PhpMyAdmin | =4.4.13 | |
| PhpMyAdmin | =4.4.13.1 | |
| PhpMyAdmin | =4.4.14 | |
| PhpMyAdmin | =4.4.14.1 | |
| PhpMyAdmin | =4.4.15 | |
| PhpMyAdmin | =4.4.15.1 | |
| PhpMyAdmin | =4.4.15.2 | |
| PhpMyAdmin | =4.4.15.3 | |
| PhpMyAdmin | =4.4.15.4 | |
| PhpMyAdmin | =4.4.15.5 | |
| PhpMyAdmin | =4.4.15.6 | |
| PhpMyAdmin | =4.4.15.7 | |
| PhpMyAdmin | =4.4.15.8 | |
| PhpMyAdmin | =4.6.0 | |
| PhpMyAdmin | =4.6.1 | |
| PhpMyAdmin | =4.6.2 | |
| PhpMyAdmin | =4.6.3 | |
| PhpMyAdmin | =4.6.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2016-9854?
CVE-2016-9854 has been rated as a high severity vulnerability due to the exposure of system path information.
How do I fix CVE-2016-9854?
To fix CVE-2016-9854, update phpMyAdmin to a version later than 4.4.15.8 or apply appropriate security patches.
What versions of phpMyAdmin are affected by CVE-2016-9854?
CVE-2016-9854 affects phpMyAdmin versions 4.4.0 through 4.4.15.8.
What type of vulnerability is CVE-2016-9854?
CVE-2016-9854 is a directory traversal vulnerability that allows exposure of the installation path.
Is my database at risk with CVE-2016-9854?
Yes, if you are using an affected version of phpMyAdmin, your database may be at risk due to potential exposure of sensitive path information.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/remedy
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/author
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/phpmyadmin
- canonical/phpmyadmin
- version/phpmyadmin/4.4.0
- version/phpmyadmin/4.4.1
- version/phpmyadmin/4.4.1.1
- version/phpmyadmin/4.4.2
- version/phpmyadmin/4.4.3
- version/phpmyadmin/4.4.4
- version/phpmyadmin/4.4.5
- version/phpmyadmin/4.4.6
- version/phpmyadmin/4.4.6.1
- version/phpmyadmin/4.4.7
- version/phpmyadmin/4.4.8
- version/phpmyadmin/4.4.9
- version/phpmyadmin/4.4.10
- version/phpmyadmin/4.4.11
- version/phpmyadmin/4.4.12
- version/phpmyadmin/4.4.13
- version/phpmyadmin/4.4.13.1
- version/phpmyadmin/4.4.14
- version/phpmyadmin/4.4.14.1
- version/phpmyadmin/4.4.15
- version/phpmyadmin/4.4.15.1
- version/phpmyadmin/4.4.15.2
- version/phpmyadmin/4.4.15.3
- version/phpmyadmin/4.4.15.4
- version/phpmyadmin/4.4.15.5
- version/phpmyadmin/4.4.15.6
- version/phpmyadmin/4.4.15.7
- version/phpmyadmin/4.4.15.8
- version/phpmyadmin/4.6.0
- version/phpmyadmin/4.6.1
- version/phpmyadmin/4.6.2
- version/phpmyadmin/4.6.3
- version/phpmyadmin/4.6.4