An issue was discovered in phpMyAdmin. When the arg_separator is different from its default & value, the CSRF token was not properly stripped from the return URL of the preference import action. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2016-12-11T02:00:00

Updated: 2024-08-06T03:07:30.178Z

Reserved: 2016-12-06T00:00:00

Link: CVE-2016-9866

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2016-12-11T03:00:08.853

Modified: 2017-07-01T01:30:17.250

Link: CVE-2016-9866

cve-icon Redhat

No data.