CVE-2015-2206
libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3...
CVE-2015-2206 is a medium vulnerability (CVSS 5.0) in Phpmyadmin, published March 9, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.26%, the 88th percentile. Fixed in phpmyadmin 4:4.4.4-1.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 3.26%EPSS, 88th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4:4.4.4-1phpmyadmin +7 more
Description
libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpmyadminDebian:12 | before 4:4.4.4-1 | 4:4.4.4-1 |
phpmyadminDebian:13 | before 4:4.4.4-1 | 4:4.4.4-1 |
phpmyadminDebian:14 | before 4:4.4.4-1 | 4:4.4.4-1 |
phpmyadminDebian:6.0 From an advisory covering 4 CVEs | before 4:3.3.7-9, plus listed versions 4:3.3.7-34:3.3.7-54:3.3.7-64:3.3.7-74:3.3.7-8 | 4:3.3.7-9 |
phpmyadminDebian:7 From an advisory covering 7 CVEs | before 4:3.4.11.1-2+deb7u2, plus listed versions 4:3.4.11.1-24:3.4.11.1-2+deb7u1 | 4:3.4.11.1-2+deb7u2 |
phpmyadminDebian:8 From an advisory covering 7 CVEs | before 4:4.2.12-2+deb8u1, plus listed versions 4:4.2.12-2 | 4:4.2.12-2+deb8u1 |
phpmyadminUbuntu:Pro:14.04:LTS | All versions, plus listed versions 4:4.0.6-14:4.0.8-14:4.0.9-14:4.0.10-14:4.0.10-1ubuntu0.1 Show 4 moreShow less4:4.0.10-1ubuntu0.1+esm14:4.0.10-1ubuntu0.1+esm24:4.0.10-1ubuntu0.1+esm34:4.0.10-1ubuntu0.1+esm4 | None known |
phpMyAdminopenSUSE:Tumbleweed From an advisory covering 124 CVEs | before 4.6.5.2-1.1 | 4.6.5.2-1.1 |
What each source reports
NVD Score used
libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
- Record
CVE-2015-2206- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE ListNo score
libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
- Record
CVE-2015-2206- Updated
- 2026-11-02
EUVDEUVD-2015-2313No score
libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
- Record
EUVD-2015-2313- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-crhx-xmfj-53jvNo score
libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3...
libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
- Record
GHSA-crhx-xmfj-53jv- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVNo score
libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
- Record
CVE-2015-2206- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-2206No score
libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
- Record
DEBIAN-CVE-2015-2206- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10054-1No score
phpMyAdmin-4.6.5.2-1.1 on GA media
These are all security issues fixed in the phpMyAdmin-4.6.5.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10054-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-2206No score
libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
- Record
UBUNTU-CVE-2015-2206- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.opensuse.org/opensuse-updates/2015-07/msg00008.html
debian.org/security/2015/dsa-3382
lists.fedoraproject.org/pipermail/package-announce/2015-March/151331.html
securitytracker.com/id/1031871
securityfocus.com/bid/72949
github.com/phpmyadmin/phpmyadmin/commit/b2f1e895038a5700bf8e81fb9a5da36cbdea0eeb
Show 133 moreShow less
mandriva.com/security/advisories?name=MDVSA-2015:186
phpmyadmin.net/home_page/security/PMASA-2015-1.php
nvd.nist.gov/vuln/detail/CVE-2015-2206
security-tracker.debian.org/tracker/CVE-2015-2206
ubuntu.com/security/CVE-2015-2206
cve.org/CVERecord?id=CVE-2015-2206
suse.com/security/cve/CVE-2011-4107