phpMyAdmin CSRF Vulnerability
Critical severity
GitHub Reviewed
Published
May 17, 2022
to the GitHub Advisory Database
•
Updated Nov 2, 2023
Package
Affected versions
>= 4.6.0, < 4.6.5
>= 4.4.0, < 4.4.15.9
>= 4.0.0, < 4.0.10.18
Patched versions
4.6.5
4.4.15.9
4.0.10.18
Description
Published by the National Vulnerability Database
Dec 11, 2016
Published to the GitHub Advisory Database
May 17, 2022
Reviewed
Jul 31, 2023
Last updated
Nov 2, 2023
An issue was discovered in phpMyAdmin. When the arg_separator is different from its default & value, the CSRF token was not properly stripped from the return URL of the preference import action. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References