NetSight
IP …
high7.5

CVE-2016-2041

libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for compari…

Impact

libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences.

Affected products

VendorProductAffected versions
FedoraprojectFedora
Versions 22, 23
PhpmyadminPhpmyadmin
Versions 4.0.0, 4.0.1, 4.0.10, 4.0.10.1, 4.0.10.2, 4.0.10.3
OpensuseLeap
Version 42.1
OpensuseOpensuse
Versions 13.1, 13.2

Weakness classification

CWE-254

References