Medium severity · published Jul 3, 2016
CVE-2016-5730
phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value…
5.3
CVSS
2.6%
EPSS
No
On KEV
Description
phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LE
Leap · Opensuse
42.1 · source: NVD
OP
Opensuse · Opensuse
13.1; 13.2 · source: NVD
PH
Phpmyadmin · Phpmyadmin
4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.4.1; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-5730
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-5730
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html
www.securityfocus.com
http://www.securityfocus.com/bid/91379
Patch
https://github.com/phpmyadmin/phpmyadmin/commit/27664605b945b13e1d2b71adea822ace2099cc96
Patch
https://github.com/phpmyadmin/phpmyadmin/commit/331c560fbfa0e7d2dce674b5e88e983c5f2a451d
Patch
https://github.com/phpmyadmin/phpmyadmin/commit/96e0aa35653ec0c66084a7e9343465e16c1f769b
More from Leap
9.8
CVE-2020-16846
SaltStack Salt Shell Injection Vulnerability
9.8
CVE-2020-12641
Roundcube Webmail Remote Code Execution Vulnerability
9.8
CVE-2020-11651
SaltStack Salt Authentication Bypass Vulnerability
9.8
CVE-2020-1938
Apache Tomcat Improper Privilege Management Vulnerability
9.8
CVE-2016-3427
Oracle Java SE and JRockit Unspecified Vulnerability