« Volver al listado

CVE-2016-6608

Estado: ModificadaMedia (6.1)—

Se descubrieron problemas de XSS en phpMyAdmin. Esto afecta a la comprobación de privilegios de la base de datos y a la funcionalidad "Eliminar particiones". Los nombres de base de datos especialmente manipulados pueden desencadenar el ataque XSS. Todas las versiones 4.6.x (anteriores a 4.6.4) están afectadas.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Phpmyadmin — Phpmyadmin

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-6608",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2016-12-11T02:59:12.970",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/93258",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://security.gentoo.org/glsa/201701-32",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.phpmyadmin.net/security/PMASA-2016-31",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/93258",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/201701-32",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.phpmyadmin.net/security/PMASA-2016-31",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the \"Remove partitioning\" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected."
    },
    {
      "lang": "es",
      "value": "Se descubrieron problemas de XSS en phpMyAdmin. Esto afecta a la comprobación de privilegios de la base de datos y a la funcionalidad \"Eliminar particiones\". Los nombres de base de datos especialmente manipulados pueden desencadenar el ataque XSS. Todas las versiones 4.6.x (anteriores a 4.6.4) están afectadas."
    }
  ],
  "lastModified": "2026-06-17T00:51:27.093",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844"
            },
            {
              "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A0EA8819-70F8-48DC-8667-6CF25E7D9C53"
            },
            {
              "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DD2796DA-3E74-4765-90D1-783849C7A44C"
            },
            {
              "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4024DA77-BFE4-48C6-A2AF-46003071BDE8"
            },
            {
              "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390"
            },
            {
              "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653"
            },
            {
              "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}