Vulnerability Description
phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Phpmyadmin | Phpmyadmin | 4.0.0 |
| Opensuse | Leap | 42.1 |
| Opensuse | Opensuse | 13.1 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html
- http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html
- http://www.securityfocus.com/bid/91379
- https://github.com/phpmyadmin/phpmyadmin/commit/27664605b945b13e1d2b71adea822acePatch
- https://github.com/phpmyadmin/phpmyadmin/commit/331c560fbfa0e7d2dce674b5e88e983cPatch
- https://github.com/phpmyadmin/phpmyadmin/commit/96e0aa35653ec0c66084a7e9343465e1Patch
- https://github.com/phpmyadmin/phpmyadmin/commit/b0180f18c828706af3a6800f0fb01a53Patch
- https://github.com/phpmyadmin/phpmyadmin/commit/cd229d718e8cb4bc8ba32446beaa82d2Patch
- https://security.gentoo.org/glsa/201701-32
- https://www.phpmyadmin.net/security/PMASA-2016-23/PatchVendor Advisory
- http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html
- http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html
- http://www.securityfocus.com/bid/91379
- https://github.com/phpmyadmin/phpmyadmin/commit/27664605b945b13e1d2b71adea822acePatch
- https://github.com/phpmyadmin/phpmyadmin/commit/331c560fbfa0e7d2dce674b5e88e983cPatch
FAQ
What is CVE-2016-5730?
CVE-2016-5730 is a vulnerability with a CVSS score of 5.3 (MEDIUM). phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2...
How severe is CVE-2016-5730?
CVE-2016-5730 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-5730?
Check the references section above for vendor advisories and patch information. Affected products include: Phpmyadmin Phpmyadmin, Opensuse Leap, Opensuse Opensuse.