NVD

Id
18348  
Name
CVE-2016-2041  
Description
libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2016-02-19  
Modified Date
2016-11-28  
Seq
2016-2041  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
101529 18348 CVE-2016-2041 FEDORA-2016-e1fe01e96e  View
101530 18348 CVE-2016-2041 FEDORA-2016-e55278763e  View
101531 18348 CVE-2016-2041 openSUSE-SU-2016:0357  View
101532 18348 CVE-2016-2041 openSUSE-SU-2016:0378  View
101533 18348 CVE-2016-2041 DSA-3627  View
101534 18348 CVE-2016-2041 http://www.phpmyadmin.net/home_page/security/PMASA-2016-5.php  View
101535 18348 CVE-2016-2041 https://github.com/phpmyadmin/phpmyadmin/commit/ec0e88e37ef30a66eada1c072953f4ec385a3e49  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
713 JVNDB-2016-001486 phpMyAdmin の libraries/common.inc.php におけるアクセス制限を回避される脆弱性 phpMyAdmin の libraries/common.inc.php は、CSRF トークンの比較に定数時間 (constant-time) アルゴリズムを使用しないため、アクセス制限を回避される脆弱性が存在します。 CVE-2016-2041 88547 CVE-2016-2041 18348 5 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-001486.html 2016-01-24 2016-02-25 View