In short
- CVE-2016-2562 is a MEDIUM (CVSS 6.8) vulnerability affecting phpmyadmin/phpmyadmin, phpmyadmin (phpmyadmin).
- Chance of exploitation in the next 30 days (EPSS): 0.78%, higher than 55.9% of all vulnerabilities.
- Fix: update to 4.5.5.1 or later.
| Package | Affected versions | Patched versions |
|---|
| phpmyadmin/phpmyadmin Packagist | ≥ 4.5, < 4.5.5.1
| 4.5.5.1
|
| phpmyadmin | = 4.5.0= 4.5.0.1= 4.5.0.2= 4.5.1= 4.5.2= 4.5.3= 4.5.3.1= 4.5.4= 4.5.4.1= 4.5.5
| No fix yet |
Description
The checkHTTP function in libraries/Config.class.php in phpMyAdmin 4.5.x before 4.5.5.1 does not verify X.509 certificates from api.github.com SSL servers, which allows man-in-the-middle attackers to spoof these servers and obtain sensitive information via a crafted certificate.
NVD description
The checkHTTP function in libraries/Config.class.php in phpMyAdmin 4.5.x before 4.5.5.1 does not verify X.509 certificates from api.github.com SSL servers, which allows man-in-the-middle attackers to spoof these servers and obtain sensitive information via a crafted certificate.
More vulnerabilities in phpmyadmin/phpmyadmin
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free