CVE-2015-2206
- State
- Published
- Severity
- Not scored
- Published
- Mar 9, 2015
- Updated
- Aug 6, 2024
- Reserved
- Mar 4, 2015
Description
libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- openSUSE-SU-2015:1191vendor-advisory
- DSA-3382vendor-advisory
- FEDORA-2015-3287vendor-advisory
- 1031871vdb-entry
- 72949vdb-entry
- https://github.com/phpmyadmin/phpmyadmin/commit/b2f1e895038a5700bf8e81fb9a5da36cbdea0eeb
- FEDORA-2015-3336vendor-advisory
- MDVSA-2015:186vendor-advisory
- FEDORA-2015-3329vendor-advisory
- http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.php
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.