7.5
CVSSv3

CVE-2016-1927

Published: 20/02/2016 Updated: 28/11/2016
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Summary

The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x prior to 4.0.10.13, 4.4.x prior to 4.4.15.3, and 4.5.x prior to 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote malicious users to guess passwords via a brute-force approach.

Vulnerable Product Search on Vulmon Subscribe to Product

phpmyadmin phpmyadmin 4.5.1

phpmyadmin phpmyadmin 4.5.0.2

phpmyadmin phpmyadmin 4.4.6.1

phpmyadmin phpmyadmin 4.4.6

phpmyadmin phpmyadmin 4.4.14.1

phpmyadmin phpmyadmin 4.4.13.1

phpmyadmin phpmyadmin 4.4.0

phpmyadmin phpmyadmin 4.0.10.12

phpmyadmin phpmyadmin 4.0.10.2

phpmyadmin phpmyadmin 4.0.10.11

phpmyadmin phpmyadmin 4.0.0

phpmyadmin phpmyadmin 4.4.15.3

phpmyadmin phpmyadmin 4.4.15.2

phpmyadmin phpmyadmin 4.4.9

phpmyadmin phpmyadmin 4.4.3

phpmyadmin phpmyadmin 4.4.2

phpmyadmin phpmyadmin 4.4.11

phpmyadmin phpmyadmin 4.4.10

phpmyadmin phpmyadmin 4.0.10.6

phpmyadmin phpmyadmin 4.0.10.5

phpmyadmin phpmyadmin 4.0.10

phpmyadmin phpmyadmin 4.0.1

phpmyadmin phpmyadmin 4.5.0.1

phpmyadmin phpmyadmin 4.5.0

phpmyadmin phpmyadmin 4.4.5

phpmyadmin phpmyadmin 4.4.4

phpmyadmin phpmyadmin 4.4.13

phpmyadmin phpmyadmin 4.4.12

phpmyadmin phpmyadmin 4.0.10.9

phpmyadmin phpmyadmin 4.0.10.8

phpmyadmin phpmyadmin 4.0.10.7

phpmyadmin phpmyadmin 4.0.10.10

phpmyadmin phpmyadmin 4.0.10.1

phpmyadmin phpmyadmin 4.5.3

phpmyadmin phpmyadmin 4.5.2

phpmyadmin phpmyadmin 4.4.8

phpmyadmin phpmyadmin 4.4.7

phpmyadmin phpmyadmin 4.4.15.1

phpmyadmin phpmyadmin 4.4.15

phpmyadmin phpmyadmin 4.4.1.1

phpmyadmin phpmyadmin 4.4.1

phpmyadmin phpmyadmin 4.0.10.4

phpmyadmin phpmyadmin 4.0.10.3

Vendor Advisories

Several vulnerabilities have been fixed in phpMyAdmin, the web-based MySQL administration interface CVE-2016-1927 The suggestPassword function relied on a non-secure random number generator which makes it easier for remote attackers to guess generated passwords via a brute-force approach CVE-2016-2039 CSRF token values were gener ...