CVE-2016-9850 Auth bypass in n/a
Timing side-channel in phpMyAdmin allow/deny rules may allow attackers to bypass authentication restrictions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-9850?
CVE-2016-9850 is a medium-severity authentication bypass vulnerability in Phpmyadmin Phpmyadmin, published on 11 Dec 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in phpMyAdmin. Username matching for the allow/deny rules may result in wrong matches and detection of the username in the rule due to non-constant execution time. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
Weakness: CWE-254
Which versions are affected by CVE-2016-9850?
It affects 1 product.
Products include Phpmyadmin Phpmyadmin.
How do I fix CVE-2016-9850?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2016-9850 being exploited?
There is no known exploitation of CVE-2016-9850 in the wild and no public exploit code.
Other vulnerabilities in Phpmyadmin Phpmyadmin
Sources
Also known as ALPINE-CVE-2016-9850, CVE-2016-1000363, DEBIAN-CVE-2016-9850, GHSA-j2wm-vcg8-rf5v, UBUNTU-CVE-2016-9850.