CVE-2015-3902 Cross-site request forgery in n/a
Remote attackers can hijack administrator sessions to modify configuration files via CSRF in phpMyAdmin setup process.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2015-3902?
CVE-2015-3902 is a medium-severity vulnerability in Phpmyadmin Phpmyadmin, published on 26 May 2015. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Multiple cross-site request forgery (CSRF) vulnerabilities in the setup process in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 allow remote attackers to hijack the authentication of administrators for requests that modify the configuration file.
Weakness: CWE-352
Which versions are affected by CVE-2015-3902?
It affects 1 product.
Products include Phpmyadmin Phpmyadmin.
How do I fix CVE-2015-3902?
Upgrade to a fixed version.
Is CVE-2015-3902 being exploited?
There is no known exploitation of CVE-2015-3902 in the wild and no public exploit code.
Other vulnerabilities in Phpmyadmin Phpmyadmin
Sources
Also known as DEBIAN-CVE-2015-3902, GHSA-4458-ww2x-8wwm, UBUNTU-CVE-2015-3902.