CVE-2017-1000016: phpMyAdmin Cookie attribute injection attack
Summary
CVE-2017-1000016: phpMyAdmin Cookie attribute injection attack. Affects phpmyadmin/phpmyadmin versions >= 4.6, < 4.6.6. Fixed in 4.6.6. How to fix ↓
Also tracked for
- phpmyadmin · Debian:11
The same CVE-2017-1000016 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
phpMyAdmin is a popular open-source tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks, such as creating, modifying, and deleting databases, tables, and records. The vulnerability identified as CVE-2017-1000016 affects phpMyAdmin versions 4.6 and earlier. This vulnerability allows an attacker to inject arbitrary values into the browser cookies, potentially leading to unauthorized access, session hijacking, or other malicious activities.
Vulnerability Detail
The vulnerability arises from an incomplete fix that was previously issued in PMASA-2016-18. It enables an attacker to manipulate the values of browser cookies, which are used to store session information and user preferences. By injecting arbitrary values into these cookies, an attacker can bypass authentication mechanisms, impersonate other users, or gain unauthorized access to sensitive data. The impact of this vulnerability is considered high, with a CVSS score of 7.5. It is crucial for phpMyAdmin users to update their installations to version 4.6.6 or later to mitigate this vulnerability.
How To Fix
Minimum fixed version
4.6.6
This is the first release that contains the fix.
composer require phpmyadmin/phpmyadmin:4.6.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended course of action is to apply the official fix by upgrading to phpMyAdmin version 4.6.6 or later.
Conclusion
The phpMyAdmin vulnerability identified as CVE-2017-1000016 allows attackers to inject arbitrary values into browser cookies, potentially leading to unauthorized access and other malicious activities. To mitigate this vulnerability, it is crucial for phpMyAdmin users to upgrade their installations to version 4.6.6 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source tool for managing MySQL databases. It provides a web-based interface for performing various database management tasks.
The vulnerability allows an attacker to inject arbitrary values into browser cookies, potentially leading to unauthorized access, session hijacking, or other malicious activities.
To fix this vulnerability, you should upgrade your phpMyAdmin installation to version 4.6.6 or later.
No, only phpMyAdmin versions 4.6 and earlier are affected. Versions 4.6.6 and later include the necessary fix.
No specific workaround is mentioned for this vulnerability. It is recommended to apply the official fix by upgrading to phpMyAdmin version 4.6.6 or later.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
