Open redirect

PMASA-2017-1

Announcement-ID: PMASA-2017-1

Date: 2017-01-24

Summary

Open redirect

Description

It was possible to trick phpMyAdmin to redirect to insecure using special request path.

Severity

We consider this vulnerability to be non critical.

Affected Versions

All 4.6.x versions (prior to 4.6.6), 4.4.x versions (prior to 4.4.15.10), and 4.0.x versions (prior to 4.0.10.19) are affected

Solution

Upgrade to phpMyAdmin 4.6.6, 4.4.15.10, or 4.0.10.19 or newer or apply patch listed below.

References

Thanks to Emanuel Bronshtein @e3amn2l for reporting this vulnerability.

Assigned CVE ids: CVE-2017-1000013

CWE ids: CWE-661

Patches

The following commits have been made on the 4.6 branch to fix this issue:

• 4c84070ad6136c3158caa93286754ebbfbce61ab
• e37bf40f44a3272a6709eb5b38feccac41658e3f

The following commits have been made on the 4.4 branch to fix this issue:

• 1e5c0ae5b44c58296e11b92497767c8677653cba

The following commits have been made on the 4.0 branch to fix this issue:

• 7fe97a1f3c4695f630e39d9433b8fa7539eee30e

More information

For further information and in case of questions, please contact the phpMyAdmin team. Our website is phpmyadmin.net.