Cross-site scripting in phpMyAdmin - CVE-2016-9856
Published: December 11, 2016 / Updated: August 4, 2020
Vulnerability identifier: #VU33577
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2016-9856
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. This issue is resolved by using a copy of a hash to avoid a race condition. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
Affected software
phpMyAdmin
phpmyadmin (Alpine package)
phpmyadmin (Alpine package)
How to mitigate CVE-2016-9856
Install update from vendor's website.
phpmyadmin (Alpine package) - update to 4.4.15.9-r0