NVD

Id
22477  
Name
CVE-2016-9847  
Description
An issue was discovered in phpMyAdmin. When the user does not specify a blowfish_secret key for encrypting cookies, phpMyAdmin generates one at runtime. A vulnerability was reported where the way this value is created uses a weak algorithm. This could allow an attacker to determine the user"s blowfish_secret and potentially decrypt their cookies. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2016-12-10  
Modified Date
2016-12-27  
Seq
2016-9847  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
119246 22477 CVE-2016-9847 94524  View
119247 22477 CVE-2016-9847 https://www.phpmyadmin.net/security/PMASA-2016-58  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
5433 JVNDB-2016-006206 phpMyAdmin におけるユーザの blowfish_secret を特定される脆弱性 phpMyAdmin は、ユーザが Cookie を 暗号化するための blowfish_secret キーを指定していない場合、実行時に脆弱なアルゴリズムを使用して一つのキーを作成するため、ユーザの blowfish_secret を特定され、Cookie を復号される脆弱性が存在します。 CVE-2016-9847 96354 CVE-2016-9847 22477 5 5.3 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-006206.html 2016-11-25 2016-12-15 View