Vulnerability Description
Cross-site scripting (XSS) vulnerability in phpMyAdmin 4.4.x before 4.4.15.6 and 4.6.x before 4.6.2 allows remote attackers to inject arbitrary web script or HTML via special characters that are mishandled during double URL decoding.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Phpmyadmin | Phpmyadmin | 4.4.0 |
| Opensuse | Opensuse | 13.1 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html
- http://www.debian.org/security/2016/dsa-3627
- http://www.securityfocus.com/bid/90877
- http://www.securitytracker.com/id/1035979
- https://github.com/phpmyadmin/phpmyadmin/commit/b061096abd992801fbbd805ef6ff74e6Patch
- https://security.gentoo.org/glsa/201701-32
- https://www.phpmyadmin.net/security/PMASA-2016-16PatchVendor Advisory
- http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html
- http://www.debian.org/security/2016/dsa-3627
- http://www.securityfocus.com/bid/90877
- http://www.securitytracker.com/id/1035979
- https://github.com/phpmyadmin/phpmyadmin/commit/b061096abd992801fbbd805ef6ff74e6Patch
- https://security.gentoo.org/glsa/201701-32
- https://www.phpmyadmin.net/security/PMASA-2016-16PatchVendor Advisory
FAQ
What is CVE-2016-5099?
CVE-2016-5099 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Cross-site scripting (XSS) vulnerability in phpMyAdmin 4.4.x before 4.4.15.6 and 4.6.x before 4.6.2 allows remote attackers to inject arbitrary web script or HTML via special characters that are misha...
How severe is CVE-2016-5099?
CVE-2016-5099 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-5099?
Check the references section above for vendor advisories and patch information. Affected products include: Phpmyadmin Phpmyadmin, Opensuse Opensuse.