CVE-2016-2038 : phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4

phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.

Published 2016-02-20 01:59:01

Updated 2018-10-30 16:27:36

Source MITRE

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2016-2038

Phpmyadmin » Phpmyadmin » Version: 4.0.0 Update RC2
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.0.1
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.0.0 Update RC3
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.0.0
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.0.10
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.0.10.1
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.0.10.2
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.0.10.3
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.0.10.4
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.0.10.5
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.0.10.7
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.0.10.8
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.0.10.6
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.4.0
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.4.1
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.0.10.9
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.4.4
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.4.5
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.4.6
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.4.1.1
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.4.3
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.4.11
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.4.12
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.4.7
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.4.8
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.4.9
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.4.10
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.4.6.1
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.4.13.1
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.4.13
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.4.2
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.4.14.1
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.4.15
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.5.0
cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.5.0.1
cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.1:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.5.0.2
cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.2:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.5.3
cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.3:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.5.2
cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.2:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.0.10.11
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.5.1
cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.1:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.0.10.10
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.4.15.1
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.0.10.12
cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.4.15.3
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*
Matching versions
Phpmyadmin » Phpmyadmin » Version: 4.4.15.2
cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 22
cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 23
cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*
Matching versions
Opensuse » Opensuse » Version: 13.2
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
Matching versions
Opensuse » Opensuse » Version: 13.1
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
Matching versions
Opensuse » Leap » Version: 42.1
cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2016-2038

Top countries where our scanners detected CVE-2016-2038

Top open port discovered on systems with this issue 21

IPs affected by CVE-2016-2038 1

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2016-2038!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2016-2038

EPSS FAQ

0.62%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 76 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-2038

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2016-2038

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-2038

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html

[SECURITY] Fedora 23 Update: phpMyAdmin-4.5.4.1-1.fc23
Third Party Advisory

CVEs referencing this url
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html

[SECURITY] Fedora 22 Update: phpMyAdmin-4.5.4-1.fc22
Third Party Advisory

CVEs referencing this url
https://github.com/phpmyadmin/phpmyadmin/commit/76b10187c38634a29d6780f99f6dcd796191073b

Fallback to default collation connection · phpmyadmin/phpmyadmin@76b1018 · GitHub
Patch
http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html

openSUSE-SU-2016:0357-1: moderate: Security update for phpMyAdmin
Third Party Advisory

CVEs referencing this url
http://www.phpmyadmin.net/home_page/security/PMASA-2016-1.php

phpMyAdmin - Security - PMASA-2016-1
Patch;Vendor Advisory
http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html

openSUSE-SU-2016:0378-1: moderate: Security update to phpMyAdmin 4.4.15.
Third Party Advisory

CVEs referencing this url
https://github.com/phpmyadmin/phpmyadmin/commit/f83b52737e321005959497d8e8f59f8aaedc9048

Do not process subforms with PMA_MINIMUM_COMMON · phpmyadmin/phpmyadmin@f83b527 · GitHub
Patch
https://github.com/phpmyadmin/phpmyadmin/commit/447c88f4884fe30a25d38c331c31d820a19f8c93

Can not use PMA_fatalError when including fails · phpmyadmin/phpmyadmin@447c88f · GitHub
Patch
https://github.com/phpmyadmin/phpmyadmin/commit/5aee5035646c4fc617564cb0d3d58c0435d64d81

Fix path disclosure, items 1.4.x, 1.5 and 1.6 · phpmyadmin/phpmyadmin@5aee503 · GitHub
Patch
https://github.com/phpmyadmin/phpmyadmin/commit/85ccdbb5b9c6c7a9830e5cb468662837a59a7aa3

Include common libraries in setup · phpmyadmin/phpmyadmin@85ccdbb · GitHub
Patch
https://github.com/phpmyadmin/phpmyadmin/commit/d4b9c22c1f8465bda5b6a83dc7e2cf59c3fe44e1

Enable localization before redirect · phpmyadmin/phpmyadmin@d4b9c22 · GitHub
Patch