CVE-2016-2039

Severity: medium (CVSS 5.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-02-20 · updated 2026-06-17
Weakness: CWE-200

Description

libraries/session.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not properly generate CSRF token values, which allows remote attackers to bypass intended access restrictions by predicting a value.

Affected products

Fedoraproject Fedora: 23, 24
openSUSE Leap: 42.1
Opensuse: 13.1, 13.2
phpMyAdmin: 4.0.0, 4.0.0-rc2, 4.0.0-rc3, 4.0.1, 4.0.10, 4.0.10.1 (+39)

References

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html
http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html
http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html
http://www.debian.org/security/2016/dsa-3627
http://www.phpmyadmin.net/home_page/security/PMASA-2016-2.php
https://github.com/phpmyadmin/phpmyadmin/commit/cb7748ac9cffcd1cd0f3081499cd4aafa9d1065e
https://github.com/phpmyadmin/phpmyadmin/commit/f20970d32c3dfdf82aef7b6c244da1f769043813
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html
http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html
http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html

Get alerted when CVE-2016-2039 or the next vulnerability affects your stack