Medium severity · published Jul 3, 2016
CVE-2016-5731
Cross-site scripting (XSS) vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to…
6.1
CVSS
1.8%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving an OpenID error message.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LE
Leap · Opensuse
42.1 · source: NVD
OP
Opensuse · Opensuse
13.1; 13.2 · source: NVD
PH
Phpmyadmin · Phpmyadmin
4.6.0; 4.6.0; 4.6.0; 4.6.0; 4.6.1; 4.6.2; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-5731
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-5731
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html
www.debian.org
http://www.debian.org/security/2016/dsa-3627
Patch
https://github.com/phpmyadmin/phpmyadmin/commit/418aeea3d83b0b6021bac311d849570acfc6e48c
Patch
https://github.com/phpmyadmin/phpmyadmin/commit/94cf3864254ffaf3a69e97d8fc454888368b94ab
security.gentoo.org
https://security.gentoo.org/glsa/201701-32
More from Leap
9.8
CVE-2020-16846
SaltStack Salt Shell Injection Vulnerability
9.8
CVE-2020-12641
Roundcube Webmail Remote Code Execution Vulnerability
9.8
CVE-2020-11651
SaltStack Salt Authentication Bypass Vulnerability
9.8
CVE-2020-1938
Apache Tomcat Improper Privilege Management Vulnerability
9.8
CVE-2016-3427
Oracle Java SE and JRockit Unspecified Vulnerability