{"id":"CVE-2016-2041","aliases":["DEBIAN-CVE-2016-2041","DLA-406-1","DLA-481-1","DSA-3627-1","EUVD-2022-3200","GHSA-8m97-xc46-rw9w","MGASA-2016-0051","UBUNTU-CVE-2016-2041","openSUSE-SU-2024:10054-1"],"status":"published","title":"phpMyAdmin Unsafe comparison of XSRF/CSRF token","description":"libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02576,"percentile":0.85301,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-203","CWE-254"],"published":"2016-01-30T00:00:00Z","modified":"2026-10-20T10:47:25Z","fixes":[{"ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","fixed_in":["4.0.10.13","4.4.15.3","4.5.4"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"phpmyadmin","fixed_in":["4:4.5.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"phpmyadmin","fixed_in":["4:4.5.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"phpmyadmin","fixed_in":["4:4.5.4-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"4.0.10.13"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4"},{"fixed":"4.4.15.3"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5"},{"fixed":"4.5.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.5.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.5.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.5.4-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:3.3.7-11"}]}],"versions":["4:3.3.7-10","4:3.3.7-3","4:3.3.7-5","4:3.3.7-6","4:3.3.7-7","4:3.3.7-8","4:3.3.7-9"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:3.4.11.1-2+deb7u3"}]}],"versions":["4:3.4.11.1-2","4:3.4.11.1-2+deb7u1","4:3.4.11.1-2+deb7u2"],"bundled":7},{"source":"osv","ecosystem":"Debian:8","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.2.12-2+deb8u2"}]}],"versions":["4:4.2.12-2","4:4.2.12-2+deb8u1"],"bundled":13},{"source":"osv","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"4.0.10.13"}]}],"versions":["4.0.0","4.0.1","4.0.10","4.0.10.1","4.0.10.2","4.0.10.3","4.0.10.4","4.0.10.5","4.0.10.6","4.0.10.7","4.0.10.8","4.0.10.9","4.0.2","4.0.3","4.0.4","4.0.4.1","4.0.4.2","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9"]},{"source":"osv","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4"},{"fixed":"4.4.15.3"}]}]},{"source":"osv","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5"},{"fixed":"4.5.4"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.15.4-1.mga5"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:5","package":"phpseclib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-1.mga5"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.0.6-1","4:4.0.8-1","4:4.0.9-1","4:4.0.10-1","4:4.0.10-1ubuntu0.1","4:4.0.10-1ubuntu0.1+esm1","4:4.0.10-1ubuntu0.1+esm2","4:4.0.10-1ubuntu0.1+esm3","4:4.0.10-1ubuntu0.1+esm4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.5.2-1.1"}]}],"bundled":124}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensuse","product":"leap"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"phpmyadmin","product":"phpmyadmin"}],"references":[{"url":"http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.debian.org/security/2016/dsa-3627","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.phpmyadmin.net/home_page/security/PMASA-2016-5.php","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/ec0e88e37ef30a66eada1c072953f4ec385a3e49","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2041","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8m97-xc46-rw9w"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-2041","tags":["advisory"]},{"url":"https://github.com/phpmyadmin/composer","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2016-0051.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17633","tags":["report"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-1/","tags":["web"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-2/","tags":["web"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-3/","tags":["web"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-4/","tags":["web"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-5/","tags":["web","report"]},{"url":"https://www.phpmyadmin.net/files/4.4.15.3/","tags":["web"]},{"url":"https://www.phpmyadmin.net/news/2016/1/28/phpmyadmin-454-44153-and-401013-are-released/","tags":["web"]},{"url":"https://www.phpmyadmin.net/news/2016/1/29/phpmyadmin-401014-44154-and-451/","tags":["web"]},{"url":"http://lwn.net/Vulnerabilities/674259/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-2041","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2041","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5734","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6626","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9866","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-2041","description":"libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences.","status":"published","published":"2016-02-20T01:00:00Z","modified":"2024-08-05T23:17:49.979Z","updated_at":"2026-11-02T14:33:33.07583Z"}],"euvd":[{"id":"EUVD-2022-3200","description":"libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences.","status":"published","published":"2016-02-20T01:00:00Z","modified":"2024-08-05T23:17:49Z","updated_at":"2026-11-03T02:22:55.100655Z"}],"ghsa":[{"id":"GHSA-8m97-xc46-rw9w","title":"phpMyAdmin Unsafe comparison of XSRF/CSRF token","description":"libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences.","status":"published","published":"2022-05-14T02:08:30Z","modified":"2024-04-24T18:13:22Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:37:45.47408Z"}],"nvd":[{"id":"CVE-2016-2041","description":"libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences.","status":"published","published":"2016-02-20T01:59:04.327Z","modified":"2026-06-17T00:43:18.777Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-254"],"updated_at":"2026-11-02T14:03:22.479119Z"}],"osv":[{"id":"CVE-2016-2041","description":"libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences.","status":"published","published":"2016-02-20T01:59:04.327Z","modified":"2026-10-20T10:47:25.8513874Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-2041","description":"libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences.","status":"published","published":"2016-02-20T01:59:04.327Z","modified":"2026-09-22T07:00:39.400891699Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"GHSA-8m97-xc46-rw9w","title":"phpMyAdmin Unsafe comparison of XSRF/CSRF token","description":"libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences.","status":"published","published":"2022-05-14T02:08:30Z","modified":"2024-04-24T18:28:57.484022Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T15:46:42.437513Z"},{"id":"UBUNTU-CVE-2016-2041","description":"libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences.","status":"published","published":"2016-02-20T01:59:00Z","modified":"2025-09-08T16:43:37Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"DLA-406-1","title":"phpmyadmin - security update","status":"published","published":"2016-01-30T00:00:00Z","modified":"2026-03-09T01:23:04.721237Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DLA-481-1","title":"phpmyadmin - security update","status":"published","published":"2016-05-18T00:00:00Z","modified":"2026-03-09T02:10:06.898037Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3627-1","title":"phpmyadmin - security update","status":"published","published":"2016-07-24T00:00:00Z","modified":"2026-03-09T01:21:28.507061Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0051","title":"Updated phpmyadmin/phpseclib packages fix security vulnerability","description":"Password suggestion functionality uses Math.random() which does not\nprovide cryptographically secure random numbers (CVE-2016-1927).\n\nBy calling some scripts that are part of phpMyAdmin in an unexpected way,\nit is possible to trigger phpMyAdmin to display a PHP error message which\ncontains the full path of the directory where phpMyAdmin is installed\n(CVE-2016-2038).\n\nThe XSRF/CSRF token is generated with a weak algorithm using functions\nthat do not return cryptographically secure values (CVE-2016-2039).\n\nWith a crafted table name it is possible to trigger an XSS attack in the\ndatabase search page. With a crafted SET value or a crafted search query,\nit is possible to trigger an XSS attacks in the zoom search page. With a\ncrafted hostname header, it is possible to trigger an XSS attacks in the\nhome page (CVE-2016-2040).\n\nThe comparison of the XSRF/CSRF token parameter with the value saved in\nthe session is vulnerable to timing attacks. Moreover, the comparison\ncould be bypassed if the XSRF/CSRF token matches a particular pattern\n(CVE-2016-2041).\n\nThe phpmyadmin package has been updated to version 4.4.15.4 in the 4.4.x\nstable branch, and the phpseclib dependency has been updated to version\n2.0.1.\n","status":"published","published":"2016-02-05T17:26:09Z","modified":"2026-04-16T06:24:43.454536383Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10054-1","title":"phpMyAdmin-4.6.5.2-1.1 on GA media","description":"These are all security issues fixed in the phpMyAdmin-4.6.5.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:07:59.433224Z","updated_at":"2026-11-02T16:58:33.135986Z"}]}}