Cookie attribute injection attack

PMASA-2017-5

Announcement-ID: PMASA-2017-5

Date: 2017-01-24

Summary

Cookie attribute injection attack

Description

A vulnerability was found where, under some circumstances, an attacker can inject arbitrary values in the browser cookies. This was incompletely fixed in PMASA-2016-18.

Severity

We consider this to be non-critical.

Mitigation factor

Properly configured server which sets PHP_SELF is not affected by this.

Affected Versions

All 4.6.x versions (prior to 4.6.6) are affected

Solution

Upgrade to phpMyAdmin 4.6.6 or newer or apply patch listed below.

References

Thanks to Emanuel Bronshtein @e3amn2l for reporting this vulnerability.

Assigned CVE ids: CVE-2017-1000016

CWE ids: CWE-661

Patches

The following commits have been made on the 4.6 branch to fix this issue:

• 3b6ed1f

More information

For further information and in case of questions, please contact the phpMyAdmin team. Our website is phpmyadmin.net.