CVE-2016-9866: CSRF

Q: What is the severity of CVE-2016-9866?

CVE-2016-9866 is known to have a medium severity rating due to the potential for Cross-Site Request Forgery (CSRF) exploitation.

Q: How do I fix CVE-2016-9866?

To fix CVE-2016-9866, you should upgrade phpMyAdmin to version 4.6.5, 4.4.15.9, or newer to patch the vulnerability.

Q: What is the impact of CVE-2016-9866?

The impact of CVE-2016-9866 allows an attacker to perform unauthorized actions on behalf of users, exploiting the CSRF vulnerability.

Q: Which versions of phpMyAdmin are affected by CVE-2016-9866?

CVE-2016-9866 affects phpMyAdmin versions prior to 4.6.5, 4.4.15.9, and all versions of 4.0.x.

Q: Is there a workaround for CVE-2016-9866?

There are no official workarounds for CVE-2016-9866; upgrading to the latest versions is the recommended action.

Published Dec 11, 2016

Updated

An issue was discovered in phpMyAdmin. When the argseparator is different from its default & value, the CSRF token was not properly stripped from the return URL of the preference import action. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.

Affected Software

66 affected componentsFixes available

composer/phpmyadmin/phpmyadmin>=4.0.0<4.0.10.18

4.0.10.18

composer/phpmyadmin/phpmyadmin>=4.4.0<4.4.15.9

4.4.15.9

composer/phpmyadmin/phpmyadmin>=4.6.0<4.6.5

4.6.5

phpMyAdmin phpMyAdmin=4.6.0

phpMyAdmin phpMyAdmin=4.6.1

phpMyAdmin phpMyAdmin=4.6.2

phpMyAdmin phpMyAdmin=4.6.3

phpMyAdmin phpMyAdmin=4.6.4

phpMyAdmin phpMyAdmin=4.4.0

phpMyAdmin phpMyAdmin=4.4.1

phpMyAdmin phpMyAdmin=4.4.1.1

phpMyAdmin phpMyAdmin=4.4.2

phpMyAdmin phpMyAdmin=4.4.3

phpMyAdmin phpMyAdmin=4.4.4

phpMyAdmin phpMyAdmin=4.4.5

phpMyAdmin phpMyAdmin=4.4.6

phpMyAdmin phpMyAdmin=4.4.6.1

phpMyAdmin phpMyAdmin=4.4.7

phpMyAdmin phpMyAdmin=4.4.8

phpMyAdmin phpMyAdmin=4.4.9

phpMyAdmin phpMyAdmin=4.4.10

phpMyAdmin phpMyAdmin=4.4.11

phpMyAdmin phpMyAdmin=4.4.12

phpMyAdmin phpMyAdmin=4.4.13

phpMyAdmin phpMyAdmin=4.4.13.1

phpMyAdmin phpMyAdmin=4.4.14

phpMyAdmin phpMyAdmin=4.4.14.1

phpMyAdmin phpMyAdmin=4.4.15

phpMyAdmin phpMyAdmin=4.4.15.1

phpMyAdmin phpMyAdmin=4.4.15.2

phpMyAdmin phpMyAdmin=4.4.15.3

phpMyAdmin phpMyAdmin=4.4.15.4

phpMyAdmin phpMyAdmin=4.4.15.5

phpMyAdmin phpMyAdmin=4.4.15.6

phpMyAdmin phpMyAdmin=4.4.15.7

phpMyAdmin phpMyAdmin=4.4.15.8

phpMyAdmin phpMyAdmin=4.0.0

phpMyAdmin phpMyAdmin=4.0.1

phpMyAdmin phpMyAdmin=4.0.2

phpMyAdmin phpMyAdmin=4.0.3

phpMyAdmin phpMyAdmin=4.0.4

phpMyAdmin phpMyAdmin=4.0.4.1

phpMyAdmin phpMyAdmin=4.0.4.2

phpMyAdmin phpMyAdmin=4.0.5

phpMyAdmin phpMyAdmin=4.0.6

phpMyAdmin phpMyAdmin=4.0.7

phpMyAdmin phpMyAdmin=4.0.8

phpMyAdmin phpMyAdmin=4.0.9

phpMyAdmin phpMyAdmin=4.0.10

phpMyAdmin phpMyAdmin=4.0.10.1

phpMyAdmin phpMyAdmin=4.0.10.2

phpMyAdmin phpMyAdmin=4.0.10.3

phpMyAdmin phpMyAdmin=4.0.10.4

phpMyAdmin phpMyAdmin=4.0.10.5

phpMyAdmin phpMyAdmin=4.0.10.6

phpMyAdmin phpMyAdmin=4.0.10.7

phpMyAdmin phpMyAdmin=4.0.10.8

phpMyAdmin phpMyAdmin=4.0.10.9

phpMyAdmin phpMyAdmin=4.0.10.10

phpMyAdmin phpMyAdmin=4.0.10.11

phpMyAdmin phpMyAdmin=4.0.10.12

phpMyAdmin phpMyAdmin=4.0.10.13

phpMyAdmin phpMyAdmin=4.0.10.14

phpMyAdmin phpMyAdmin=4.0.10.15

phpMyAdmin phpMyAdmin=4.0.10.16

phpMyAdmin phpMyAdmin=4.0.10.17

Remediation

Patch Available

https://www.phpmyadmin.net/security/PMASA-2016-71

Event History

Dec 11, 2016

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

May 17, 2022

Advisory Published

02:36 AM

Frequently Asked Questions

What is the severity of CVE-2016-9866?

CVE-2016-9866 is known to have a medium severity rating due to the potential for Cross-Site Request Forgery (CSRF) exploitation.

How do I fix CVE-2016-9866?