Information disclosure in Phpmyadmin
CVE-2015-2206
libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
Vulnerability class: Information Disclosure
EPSS: 0.033 (87.1th percentile) — read the EPSS interpretation.
Affected products
- Phpmyadmin — versions 4.0.0, 4.0.1, 4.0.2
- Fedoraproject Fedora — versions 20, 21, 22
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (vendor-advisory, x_refsource_SUSE)
- cve@mitre.org (vendor-advisory, x_refsource_DEBIAN)
- cve@mitre.org (vendor-advisory, x_refsource_FEDORA, Third Party Advisory)
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (vendor-advisory, x_refsource_FEDORA, Third Party Advisory)
- cve@mitre.org (vendor-advisory, x_refsource_MANDRIVA, Broken Link)
- cve@mitre.org (vendor-advisory, x_refsource_FEDORA, Third Party Advisory)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)